Integrating OAuth2 into my app

[msteele3]

Hello,

I am a student who has been working on a canvas LMS integrated application that helps with my classes. I was trying to set up OAuth2 for it so I could have a better login experience but the docs say that the app needs to be registered and are quite unclear on the actual steps to set it up.

Currently, I just paste in and securely store the auth token in the back end but going to my account settings and finding it is not a smooth application flow, and so in the interest of having others be able to use my app I want to use OAuth2 to make it smoother.

I was wondering if anyone could point me in the right direction as to how to register an app/set up the OAuth2 flow for a web app.

[chriscas]

Hi @msteele3,

You can check out the OAuth2 - Canvas LMS REST API Documentation page for information about the general OAuth2 flow with Canvas.  You will need to work with a Canvas administrator to set up the developer key that's used in the oAuth2 flow before you'll be able to use it.  There may be some steps you'll need to do to get your app approved, and perhaps your school/institution may even say "no", but I'd strongly urge you not to ask/prompt users for their own API Tokens, as that's a violation of the Canvas Terms of Service.  Your personal API token is great for testing, doing your own things, proof of concepts, etc, but once you want others to use your app, the OAuth2 flow (with or without LTI) is definitely the way you need to go.

Hope this helps!

-Chris

[msteele3]

Thanks for the reply! Good catch on the TOS, I had not noticed that because it is not in the TOS but in the tutorial for the OAuth2. For next steps, how do I find the canvas administrator I would need to talk to for this? 

[chriscas · Accepted solution]

Hi @msteele3,

Getting a developer key installed in a Canvas instance might be the hardest part of this.  Your school will likely have a Canvas admin running their instance (usually in the eLearning / IT / Digital Education areas), but they may not want to give you access to their real Canvas instance.  Some schools have separate Canvas instances just for testing and evaluating tools, but I have no way of knowing if your specific school has that.  If you're tech savvy, you could run your own Canvas instance (see Production Start · instructure/canvas-lms Wiki · GitHub), but it will require a server and probably quite a bit of time to configure and test, so finding the Canvas team at your school would be the way I'd suggest starting.

Hope this helps!

-Chris

[msteele3]

Thank you so much Chris!