Install the external app
Install the registered app by client ID at the right account scope, record the deployment ID, and choose between strict and self-service deployment-ID policy.
With the LTI key enabled, install the external app so it appears in Canvas navigation.
Add the app by client ID
At the root account (or the desired account scope), open the external-app
configuration area and add the app by client ID. Paste the LTI_CLIENT_ID
from the LTI key step and approve the registration.
Record the deployment ID
Canvas assigns a deployment ID on installation. Record it — it becomes
LTI_DEPLOYMENT_ID.
Deploy a revision with the real IDs
Set LTI_DEPLOYMENT_ID (and the real LTI_CLIENT_ID) and deploy a new revision
before testing. On Google Cloud, add numbered Secret Manager versions and submit
Cloud Build with those exact pins. On Docker/VPS, update the mounted secret or
protected environment and recreate the app container.
By default, the service rejects launches from a deployment ID that is not explicitly configured.
Choose the deployment-ID policy
Strict (default)
LTI_DEPLOYMENT_ID_CHECKING_ENABLED=true. Only the deployment ID(s) you configure are accepted. Use this for controlled, admin-installed rollouts. Supports a comma/newline allowlist for multiple installs.
Controlled self-service
LTI_DEPLOYMENT_ID_CHECKING_ENABLED=false. Accepts any non-empty deployment ID in a signed launch from the configured issuer and client ID — for letting instructors add this exact app to their own courses.
Only relax checking if the installers are trusted
Self-service mode still enforces token signatures, issuer/audience, nonce, target-link, and browser/state validation — it removes only the preconfigured allowlist. Use it only if everyone who can install this client ID in Canvas is trusted to grant access to the tool.
Choose the account scope
| Scope | Use it for |
|---|---|
| Root-account installation | A broad rollout and the school administrator dashboard. Recommended. |
| Course-level installation | An isolated instructor/student pilot only. Does not provide the root-account navigation surface. |
Do not install the same registration both account-wide and course-local in the same course unless you intend duplicate navigation entries.
If the tool does not launch, or the admin dashboard is missing, see Troubleshooting → Canvas launch.
Next: Load the detector script.