As an admin, you can configure LTI 1.3 (LTI Advantage) single sign-on (SSO) so your users launch Impact directly from Canvas without a separate login. Canvas remains your primary identity provider (IdP), and Impact trusts Canvas to verify user identities.
Once SSO is set up, a user clicks the Impact link in their Canvas navigation, Canvas authenticates the user through LTI 1.3 (OIDC), and Impact opens in a new tab with the user already logged in.
Notes:
- Developer Keys is an account permission. If you cannot view the Developer Keys link in Account Navigation, this permission has not been enabled for your user account.
- LTI SSO handles authentication, but it does not provision new user accounts. Users must already be invited to Impact, or have access through your organization's onboarding flow, to log in.
- Forced LTI is optional and requires two steps: configure the LTI yourself, then submit a ticket to Impact Support to turn on the Forced LTI option. Once it's active, Impact admins can only launch Impact through the LTI in Canvas and can't sign in directly at app.impact.instructure.com.
Prerequisites
Before you begin, confirm you have the following:
- Canvas Administrator access, with permission to create developer keys and external apps.
- A current Impact subscription.
- Impact Subscription Administrator access, with permission to change single sign-on settings.
Set Up the Configuration in Impact
Open Impact Settings
Log in to your Impact administrator dashboard. In the top-right corner, click the Settings icon [1], then select Settings link [2].
Edit Single Sign-On Account
Click the Single sign-on tab [1]. In the table, find the account that should have LTI enabled. Hover over the row, then click the Edit button [2].
Under the LTI platform information, enter the following standard Canvas endpoints:
Copy the Generated URLs
Impact generates three URLs for your instance: a JWKS URL [1], an OpenID Connect Initiation URL [2], and a Target Link URI [3]. Copy all three values. You'll paste them into Canvas in the next section.
Keep this browser tab open. You'll return here to finish the setup.
Create a developer key in Canvas
Open Developer Keys
In a new tab, log in to Canvas as an administrator. In Global Navigation, click the Admin link [1], then click the name of your account [2].
In Account Navigation, click the DeveloperKeys link [3].
Add an LTI Key
Click the AddDeveloperKey button [1], then click the LTIKey option [2].
Enter Settings
Enter the basic settings for the key:
- Key Name [1]: Impact
- Owner Email [2]: your preferred IT or administrator contact email
- Method [3]: select Paste JSON from the drop-down menu
Copy the template below, paste it into the configuration block [4], and replace each placeholder with the matching URL you copied from Impact.
{
"title": "Impact",
"description": "Impact Analytics",
"target_link_uri": "PASTE_YOUR_TARGET_LINK_URI_HERE",
"oidc_initiation_url": "PASTE_YOUR_OIDC_INITIATION_URL_HERE",
"oidc_initiation_urls": {},
"public_jwk_url": "PASTE_YOUR_JWKS_URL_HERE",
"public_jwk": {},
"custom_fields": {},
"scopes": [],
"extensions": []
}Save Key
Click the SyncURIs button [1] so Canvas parses the data correctly, then click the Save button [2].
These settings make Impact open in a clean, full-sized browser tab.
Set the Privacy Level
Find your new developer key and click the Edit icon [1]. Under Additional Settings [2], set the Privacy Level to Public [3] so user context passes safely.
Add Account Navigation
In the Placements drop-down menu, select AccountNavigation to pin Impact to your sidebar.
Update the Placement JSON
Switch the configuration method back to Paste JSON [1]. Locate the placements section at the bottom of the JSON [2], and update it to match the snippet below. This forces Canvas to launch Impact in a new window. Then click the Save button [3]
"placements": [
{
"placement": "account_navigation",
"message_type": "LtiResourceLinkRequest",
"windowTarget": "_blank"
}
]Activate the Key
In the Developer Keys table, find the numeric Client ID in the Details column. Use the top number [1], and don't click Show Key. Copy this Client ID, then toggle the key State from Off to Enabled [2].
Add the Impact app to Canvas
Open App Configurations
In Admin Navigation, click the Settings link [1], then click the Apps tab [2]. Click the ViewAppConfigurations button [3].
Add the App by Client ID
Click the AddApp button [1]. In the Configuration Type drop-down menu, select ByClientID [2]. Paste the Client ID you copied [3], then click the Submit button [4]. When Canvas finds the tool, click the Install button.
Copy the Deployment ID
Find the Impact entry in your app list, click the Settings icon [1], then select DeploymentID [2]. Copy the Deployment ID. Impact is now available in Canvas.
Finalize the Configuration in Impact
Enter the Client ID and Deployment ID
Return to the Impact browser tab you left open. Paste your Canvas Client ID [1] and Deployment ID [2] into their fields.
Click the Save button [3] on the LTI configuration menu, then click Save on the main Settings page to commit your changes.
Test the configuration
Before you roll this out to your team, verify the setup:
- Open your Canvas Admin dashboard.
- Click the Impact link in your account navigation sidebar.
- Confirm that a new tab opens, that you bypass the Impact login prompt, and that you land on your active dashboard.
Troubleshooting
Issue
|
Likely cause
|
Resolution
|
|---|
Redirect error
|
Redirect URI mismatch
|
Verify that the Canvas Target Link URI exactly matches the URI on
your Impact setup screen.
|
User not logged in
|
Account missing in Impact
|
Confirm the user has received and accepted an active invitation to
Impact.
|
Missing email or profile errors
|
Incorrect Privacy Level
|
Set the developer key Privacy Level to Public in Canvas.
|
App not visible
|
Placement not active
|
Confirm that Account Navigation is listed under active placements
in the developer key settings.
|
Note: If you hit an error these steps don't resolve, contact Impact Support and include your Canvas Client ID, your Deployment ID, and the approximate timestamp of the failed login attempt.
Glossary
- LTI: Learning Tools Interoperability, the standard protocol for connecting an LMS with external applications.
- OIDC: OpenID Connect, the identity verification protocol that signs users in.
- JWKS: JSON Web Key Set, the cryptographic keys that verify data passed between Canvas and Impact hasn't been tampered with.
