How does my LTI app communicate with Canvas?

[carmine]

I think I'm missing something sort of fundamental. I've used the API before (written some nice command line tools). I've taken the LTI course, and I'm at the point where I have OAuth working and I can get my LTI app to show up in the menu in canvas and have it appear inside an iFrame.

So my question is:

How does my LTI app query/get stuff out of canvas?

Am I supposed to use the API as I have been doing with my command line tools? If so, what APIKey do I use, or is there someway to use the API with the same credentials as the incoming user? Or is there an entirely different set of commands I can do with LTI.

Thanks!

-Carmine

[pklove · Accepted solution]

LTI itself only has very limited capabilities to interact with Canvas.  It will receive some information on launch and it can send some limited things to Canvas, eg., pass a grade back.  LTI itself has nothing to do with OAuth or the API.

To do anything more than this, you need to use the API.  For your LTI tool to do this, it needs to get a token using OAuth or, depending on what the tool is/does, it might use a user generated token.

[themidiman]

I would like to add that LTI OAuth gets your app the ability to store an API token for the user that's logged into Canvas. That API token can then be used to perform actions on behalf of the user based on the role in Canvas. A great example LTI application of this workflow is the UDOIT project. Once the LTI launch and OAuth process sucessfully completes the software uses the instructor/designer/admin role API token to perform a whole heck of a lot of automated processes that scans course content on behalf of the logged in user to generate a report and nail down accessibility issues.

[carmine]

JEFHQ12951 and pklove‌ 

Thanks for your help and I'm almost there... I've used the API before using the API token from inside my account. My question is, how does my APP get that token.

I'm able to add my app to the menu, then click on it and do all the LTI stuff. I'm at the point where I have a ton of variables passed to me (launch_presentation stuff, user_id, roles, etc.) however... I'm not seeing the APIKEY in there. 

Is there some way for my app to get it's own token automatically? Or generate something? Is it what's going on in here? Do I need to bounce them back the first time then store it or something?

OAuth2 - Canvas LMS REST API Documentation 

[pklove]

No, the app cannot get a token automatically.

Depending on what your application is, you either need to go through the OAuth2 flow (as per your link) , or if it is something like an admin tool, you might create a dedicated API user and generate a token.

For the OAuth2 generated access token, you can cache the token and use it for an hour.  It then expires.  If you do not want the user to go through the OAuth2 process again, you can store the refresh token and use that to get a new access token when you need one.

[carmine]

Is there documentation on the complete end to end of this?  I feel as though I'm sort of stringing together bits and pieces of things. It would be great if there was something explaining not just getting the app to show up in an iframe, but also the process you mentioned above.

Thanks for your... I can't believe how fast you respond help!

[pklove]

They are two separate things. 

You can have an LTI tool that does not use the API.  And you can have an app that is not an LTI tool but uses the API.

The two are often mixed up or thought of as being related.  Although many LTI tools also need the API to implement their functionality, I think it is still best to be clear about the distinction.

Because of this distinction, you need the two sets of documentation: LTI for that component, and Canvas API for that component.  So any "end to end" documentation would need to cover both separately anyway.