nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Application Key Timestamp Notice

Steve Proud

Some customers may be experiencing limited disruption to integrated tools relying on application keys. Our team reissued certain application keys as a precautionary step, which requires end users to re-authorize access to those tools. Reissued application keys contain a timestamp in the name and will be visible to users during re-authorization.

These are valid Instructure created keys and users should continue the authorization process.

Application key contains the 2026-04-30 timestamp.

This authorization screen is a normal part of launching integrated tools in Canvas for the first time. If the key name includes a timestamp, that's expected. Select Authorize to continue.

Find more posts tagged with

Admin

Student

Instructor

Comments

WilliamSause26675767

Will I need to reauthorize every time I attempt to access the external tool from Canvas or is this just a temporary fix? Also, other integration issues continue to occur such as the gradebook no longer synching.

rtoon

What other keys and/or tokens may have been revoked or need to be reissued? I've had reports from internal teams that use access tokens or oauth2 credentials (CD2) that their existing access is no longer working. I've also reached out to our CSM in case that's specific to our instance vs. a broad answer.

Kristin Lundstrum

Hello, @WilliamSause26675767 - No, you will not need to reauthorize each time. You'll need to only to the first time you re-accesses an application after the refresh.

Kristin Lundstrum

Hi @rtoon - All key rotations are complete and no further actions are required from our customers at this time.

CD2 is in maintenance status for now. CD2 access is not tied to the key rotation. Non-CD2 access should not be impacted at this time.

The best source of info remains the status page.

emlarson

Two vendors reached out to us saying that their keys were affected and needed a root admin to reauthorize them; I quickly reauthorized those for our school's instance, but no other vendors have contacted us and problem reports have been really sparse. (e.g. We got one report from a faculty member about one textbook on Friday, and two reports from faculty about a different textbook vendor, but nothing else.) Without a list of reset keys from Instructure or a contact from a vendor informing me of a need to reauthorize their integration, I'm reluctant to start poking around as an admin and tinker with integrations that might actually be working fine. Our CSM has emphasized that the technical teams are focused on the investigation rather than keeping Support and the CSMs informed so even if our faculty reach out to Support and report a problem with X, Y or Z tool I don't think they have enough information on-hand to say, "Oh, that's one of the vendors affected by the revocation; let me notify your field admin to reauthorize that from a root admin account!"

(The basic challenge is that Instructure has been clear that some things might need to be reauthorized, but the response to "which things?" is "whatever thing needs it." That's tough to navigate.)

Chris

Hi @emlarson,

From your root account → settings → reports area, you can run the developer keys report. Once you get the report, you can look for all keys with the timestamp included to get a comprehensive list of things that were modified. Just know that you may not be using many of the inherited keys included in the report.

-Chris