Canvas setup overview
What to register in Canvas, in what order, and the endpoints and values you will move between Canvas and your deployment.
With the service deployed and reachable, you now register it in Canvas. This section creates two developer keys, installs the app, and loads the detector script. Do it in order — each step produces a value the next one (or your redeploy) needs.
Deploy first
Your public TOOL_URL must be final before you create Canvas registrations, and
the LTI registration document is served by the running service at
${TOOL_URL}/lti/config. If you have not deployed yet, start with
Deploy the application.
Before you touch Canvas
Confirm these service endpoints respond on the deployed URL:
curl -fsS "${TOOL_URL}/health"
curl -fsS "${TOOL_URL}/lti/config"
curl -fsS "${TOOL_URL}/.well-known/jwks.json"
curl -fsS "${TOOL_URL}/js/canvas-seb-detector.js" | head${TOOL_URL}/setup and /setup/guide provide a public, role-oriented checklist.
They confirm the service responds — not that Canvas has stored the intended
registration or loaded the detector.
The order
Create the API OAuth Developer Key
User-scoped Canvas OAuth for assessment discovery and access-code changes, with a specific scope set. → API OAuth key
Create the LTI 1.3 Developer Key
Registered from ${TOOL_URL}/lti/config using dynamic registration where Canvas
offers it. → LTI 1.3 key
Install the external app
Install by client ID at the intended account scope and record the deployment ID. → Install the app
Load the detector script
Add the theme JavaScript loader so the detector runs on quiz pages. → Detector script
Then redeploy with the real LTI client and deployment IDs (pass 2), and verify the integration.
Values to record
| Value | Canvas source | Runtime destination |
|---|---|---|
CANVAS_DOMAIN | The Canvas base origin (e.g. https://canvas.example.edu) | CANVAS_DOMAIN |
LTI_CLIENT_ID | LTI 1.3 Developer Key client ID | LTI_CLIENT_ID |
LTI_DEPLOYMENT_ID | External App deployment ID after install | LTI_DEPLOYMENT_ID (when checking is enabled) |
CANVAS_API_CLIENT_ID | API OAuth Developer Key client ID | CANVAS_API_CLIENT_ID |
CANVAS_API_CLIENT_SECRET | API OAuth Developer Key secret | CANVAS_API_CLIENT_SECRET |
CANVAS_REDIRECT_URI | OAuth callback registration | ${TOOL_URL}/api/oauth2callback |
The two client IDs are different
The LTI client ID and the Canvas API OAuth client ID come from different registrations. Mixing them breaks either signed LTI launches or Canvas API authorization. Keep them clearly labeled.
Self-hosted Canvas
If your Canvas is self-hosted (not *.instructure.com), read
Self-hosted Canvas before registering. You
will need to override authorization/JWKS endpoints, confirm the exact issuer, and
possibly rotate Canvas signing keys and use the hosted detector-loader workaround.
Prerequisites for this section
You need a Canvas administrator who can manage Developer Keys, external apps, account themes, and OAuth scopes — plus the deployed service URL and access to the secret store that supplies its runtime values.
Certificate management
Create, configure, validate, and rotate the SEB configuration-encryption identity — the certificate that decides which devices can open a configuration.
Create the API OAuth key
Create the Canvas API OAuth Developer Key with the exact application and administrator scopes, and handle scopes that do not appear in the UI.