Developer key authorization

[gangh]

With developer key for an external app, a user needs to accept/approve it  with authorization button in order to lunch the app.  Is this a one time process? Does it require user to click authorization button every time when user needs to use the tool?

[James]

 @gangh  

It depends on how the developer writes their code.

The Canvas OAuth2 documentation recommends that your tool hold on to the token so that you can refresh in the future without requiring the user to agree again.

When appropriate, applications should store the token locally, rather than requesting a new token for the same user each time the user uses the application. If the token is deleted or expires, the application will get a 401 Unauthorized error from the API, in which case the application should perform the OAuth flow again to receive a new token. You can differentiate this 401 Unauthorized from other cases where the user simply does not have permission to access the resource by checking that the WWW-Authenticate header is set.

[gangh]

Thanks. This answered my question.

[erinhmcmillan]

Hi, Gang,

You can learn how developer keys work in Canvas using this lesson: How do I manage developer keys for an account? 

You may also be interested in Developer Keys - Canvas LMS REST API Documentation 

Hope that helps!

Erin