# Create the LTI 1.3 key

> Create the separate Canvas LTI 1.3 Developer Key from the service's JSON configuration URL, then record the client ID.

[Canonical HTML page](https://safeonlineexam.com/docs/canvas/lti-key)

Create a **separate** LTI 1.3 Developer Key (distinct from the API OAuth key).
Use the service's JSON configuration URL so the deployed service remains the
registration source of truth. This Canvas workflow is not the separate OpenID
Dynamic Registration protocol.

## Use Canvas's JSON configuration URL [#use-canvass-json-configuration-url]

In Canvas, select the JSON configuration URL option and enter:

```text
${TOOL_URL}/lti/config
```

The document supplies the title, the course-navigation and root-account-navigation
placements, the OIDC initiation URL, the target link URI, the public JWKS URL, and
the signed course/account/user/role custom fields.

<Callout title="About the account placement">
  The account placement is marked root-account-only and administrator-visible. The
  server still independently requires the signed LTI Administrator role, Canvas's
  signed root-admin substitution, numeric account identifiers, and a matching
  account-admin OAuth grant before the dashboard does anything — the placement
  visibility is not the security boundary.
</Callout>

## If Canvas requires manual fields [#if-canvas-requires-manual-fields]

If your Canvas cannot use the configuration URL, these are the fields:

| Canvas field           | Value                               |
| ---------------------- | ----------------------------------- |
| JSON configuration URL | `${TOOL_URL}/lti/config`            |
| OIDC initiation URL    | `${TOOL_URL}/lti/login`             |
| Target link URI        | `${TOOL_URL}/lti/launch`            |
| Redirect URI           | `${TOOL_URL}/lti/launch`            |
| Public JWK URL         | `${TOOL_URL}/.well-known/jwks.json` |

## Enable and record [#enable-and-record]

Enable the key and record its **client ID** as `LTI_CLIENT_ID`. You will place
this into your secret store during the pass-2 redeploy, together with the
deployment ID from the next step.

<Callout type="warn">
  This client ID is **not** the same as `CANVAS_API_CLIENT_ID`. Keep the two clearly
  labeled — mixing them is a common cause of launch or authorization failures.
</Callout>

Next: [Install the external app](/docs/canvas/install-app).