Avoid Asking LTI 1.3 Integration Users to Update Their Developer Keys

I'm working on an LTI 1.3 integration and I've noticed that I have to reach out to users every time there is an update that requires changes to the corresponding developer key (new custom fields, placement, additional permissions for OA2, …). This is extremely inconvenient to users since they often have to enlist the help of their IT and it could take several days just to make a small change. Is there a way around this? I've read about "inherited keys" which are distributed by Instructure itself, but it entails qualifying as a partner first.

Find more posts tagged with

Apps & LTIs

developer key

Accepted answers

All comments

Chris

Hi @Iheb45713122,

Just to start off, I don't know of a way around reconfiguration outside of the inherited keys. The inherited keys may be your best option, but I'm not sure if Instructure has any limitations around the number of updates or kind of updates you can do on a regular basis.

Speaking as a Canvas admin for my institution, apps that require frequent updates would make me nervous. There are often extensive approval chains in place to safeguard institutional data, student data, privacy, etc…. If the configuration is changing on a regular basis, that would either be extra work to re-evaluate or would be something we'd need to consider at install time (possibly reducing the chance the app would be approved).

On the other hand, as an intermediate developer (not of LTI's just some customizations), I do understand that everything can't always stay static, especially if you're trying to expand app functionality.

This is a tough one overall, but I might perhaps recommend until your app is a bit more stable (at least in the configuration it needs) then consider joining the partner program to see if it would qualify to get an inherited key.

I know this post is a bit all over the place, but I hope it helps in some way. I'm sure others may have some differing thoughts of their own to share.

-Chris

ColinMurtaugh

I'll also add that as a Canvas admin, I hate inherited keys. They're a black box to us and they make it difficult for us to assess the risk associated with using a particular app. We always request that vendors use a regular developer key that we can configure ourselves, and will only use an inherited key as a last resort. The changes that you're talking about — permissions, placements, custom fields — impact us and we absolutely do not want them changing without us having a chance to review them.

As Chris says, your developer key settings shouldn't need to change much once your initial development work is done. I would also be concerned if a vendor was frequently requesting changes to the key settings.

JamesSekcienski

Personally as a Canvas admin, I prefer manually managed Developer Keys to Inherited Developer Keys. Inherited Developer Keys make it more difficult for us to modify when there are certain features we don't want enabled or want enabled differently, such as not enabling certain placements and/or ensuring the course navigation is hidden by default in most cases. When Inherited Developer Keys are updated, we are not always notified of changes and sometimes those updates also lead to resetting things we were able to customize and we have to change them back.

I would much rather have a place to refer to the vendor documentation for the supported LTI install instructions and features with a change log. In addition, the vendor should have a process in place for notifying the appropriate users of upcoming changes for new features that can be added, features being removed, and/or necessary changes for the integration to continue to work. These changes should be provided with enough advanced notice for institutions to evaluate and prepare for as well with their change management processes and contacting the appropriate staff members, such as IT as you mentioned. Thinking that needing to wait a several days for a change to be reviewed and implemented by IT is concerning since a small change to you may have bigger impacts/concerns than you realize.

Changes to placements impacts workflows, training, documentation, and support. As a school that uses blueprints to manage course content, we also need sufficient warning so course content can be updated as needed and we should not need to make a change to how the tool is used in the middle of semester.

Changes to custom fields and additional permissions are also concerning that you want to do that without going through schools to review. The data you are requesting to access and/or modify should be vetted by the school to determine if it is appropriate. There have been times when vendors request more permissions than they need to perform necessary functions and we deny allowing those permissions.

We understand needing to update integrations to accommodate new features after they are available and that this may include adjustments to custom fields and permissions to take advantage of those new features. However, the existing integration should still continue to function as it was even if we don't enable those new features right away. Unless, we are piloting an integration for a tool that we know is in active development, we expect the integration to be fairly stable once it is installed and that it shouldn't need regular updates. Most of our LTIs we have not had to modify once installed other than upgrading from LTI v1.1 to LTI v1.3.

Unanswered Questions

Concluded Course and Canvas Data Services
Canvas Data Services sent out an alert that a course was concluded (because the course was concluded) and the status of each user in the UI is set to complete, however, the enrollments API endpoint shows the status of each user in the course as active. Is this a common issue? Have I misinterpreted how the individual…
Canvas Media Question
How can one track Canvas Media use without having the reports available from Canvas Studio? Checking API endpoints and the Data 2 schema, there do not seem to be dedicated Canvas Media endpoints. Am I missing some? A method I've considered is using the body field of the wiki_pages table, as this contains the html code of…
Canvas Catalog API - Completed Certificates
Hello, I'm trying to utilize an API call to pull completed certificates and was hoping to download and store the certs as a backup. I can successfully run the API call but it will not allow me to view the certificate unless I access the URL while signed into an account where it's "my" cert. Is there a permissions setting…
UI for weekly progression idea
UI for weekly progression idea that rest in the Schedule tab of the **K-12 UI** of Canvas it's incomplete and I really would not take it and push it into instance but I am going to post it here because in the past people like @James && @robotcars || @Steve_25 have had terrific input in the past... maybe w/their eyes and…
Canvas integration with React + Flask webapp - initially for authenticaiton
I have a new React + Flask webapp. It has its own login for users to start using the app. I have added this as an external tool in Canvas. What I want initially is to see of canvas users can start using the webapp without having to login if they click on the external tool link in a canvas course. I have 2 methods…