Create the LTI 1.3 key
Register the LTI 1.3 Developer Key using the service's dynamic registration document, and record the client ID.
Create a separate LTI 1.3 Developer Key (distinct from the API OAuth key) and use dynamic registration wherever Canvas offers it. The service is the registration source of truth — prefer the dynamic document over hand-copying fields.
Dynamic registration
Point Canvas's dynamic registration at:
${TOOL_URL}/lti/configThe document supplies the title, the course-navigation and root-account-navigation placements, the OIDC initiation URL, the target link URI, the public JWKS URL, and the signed course/account/user/role custom fields.
About the account placement
The account placement is marked root-account-only and administrator-visible. The server still independently requires the signed LTI Administrator role, Canvas's signed root-admin substitution, numeric account identifiers, and a matching account-admin OAuth grant before the dashboard does anything — the placement visibility is not the security boundary.
If you must register manually
If your Canvas cannot use dynamic registration, these are the fields:
| Canvas field | Value |
|---|---|
| Dynamic JSON configuration | ${TOOL_URL}/lti/config |
| OIDC initiation URL | ${TOOL_URL}/lti/login |
| Target link URI | ${TOOL_URL}/lti/launch |
| Redirect URI | ${TOOL_URL}/lti/launch |
| Public JWK URL | ${TOOL_URL}/.well-known/jwks.json |
Enable and record
Enable the key and record its client ID as LTI_CLIENT_ID. You will place
this into your secret store during the pass-2 redeploy, together with the
deployment ID from the next step.
This client ID is not the same as CANVAS_API_CLIENT_ID. Keep the two clearly
labeled — mixing them is a common cause of launch or authorization failures.
Next: Install the external app.
Create the API OAuth key
Create the Canvas API OAuth Developer Key with the exact application and administrator scopes, and handle scopes that do not appear in the UI.
Install the external app
Install the registered app by client ID at the right account scope, record the deployment ID, and choose between strict and self-service deployment-ID policy.