Admin Guide Navigation

Cidi Labs Developer Keys and OAuth

How does DesignPLUS access Canvas Data

This page describes how developer keys and OAuth tokens work as well as how DesignPLUS handles this information.

Scoped OAuth Tokens

In their July 14, 2018 release, Canvas introduced the ability to specify which API calls can be used by tokens created by Vendor developer credentials. Cidi Labs supports scoped credentials and has inherited credentials setup with Canvas.

Permissions

DesignPLUS for Canvas accesses information in Canvas in order to help with the course development process. See the Developer Key Scoping page for more information.

Someone using DesignPLUS cannot access any data or complete any tasks using the Canvas API that they do not have access to through the Canvas User Interface (UI).

Before we look at what APIs are used, we are going to talk about how these APIs are accessed.

OAuth Tokens

An application can request permission to act on behalf of a user. If you have ever seen a screen like this:

You have some experience with OAuth tokens. You can read more about OAuth tokens below. The Multi-Tool and the Upload/Embed Image LTI tools collect and use OAuth tokens.

Direct Access

When a user is logged into Canvas, they can access an API directly through their browser. These calls only work from inside of Canvas. JavaScript inside of Canvas can be used to access these calls. The rich content editor tools use this method to access Canvas information.

Developer Keys

In order for an application to request an OAuth token, it has to have access to a developer key that will work for your institution. There are three ways for a developer to get a developer key.

1. Direct from Canvas

In the earlier days of Canvas, developers would request developer credentials direct from Canvas. These credentials were valid for requesting OAuth tokens for any cloud hosted instance of Canvas. This method definitely has its drawbacks since tools can be requesting user tokens without an institutions knowledge. This method has been replaced by Canvas' new inherited scoped tokens.

2. Inherited Credentials

As part of the move to scoped credentials in the fall of 2018, Canvas introduced the ability for tools to configure developer credentials that can be turned on at the institution level. The direct from Canvas tokens created over the years are now listed in Canvas in a way that they can be turned on or off. This is the preferred method. These credentials can be turned on/off by the institution at any point.

3. Developer Credentials generated by the institution

The third method for acquiring developer credentials is for an administrator at a given institution to generate credentials for a specific tool or set of tools. This method gives control of those credentials to the institution. At any point an institution can revoke developer credentials by deleting them from Canvas. Prior to Canvas creating inherited option, this was the only way for tokens to be controlled at the institution level.

Additional Resources:

OAuth2 Overview from Canvas API documentation