Accessing data from multiple domains

[5nstewart23]

Is it possible to access data from multiple domains using the API? I have an app that could be used by any Canvas user, and I want to allow users to type in their domain - school.instructure.com, school2.instructure.com, etc. and then I can use Oauth2 to authenticate and then pull data for that user using the API. Since I can't get a developer key from every user's domain to use in the Oauth2 process, can I use the developer key issued by my domain, or is there a universal key that I need to be using instead?

[James · Accepted solution]

You cannot use a key from your domain to work with other instances. That would be a huge security flaw.

Please check out Developer Keys - Canvas LMS REST API Documentation . The second paragraph answers your question and mentions a global developer key.

Developer keys created in a root account, by root account administrators or Instructure employees, are only functional for the account they are created in and its sub-accounts. Developer keys created globally, by an Instructure employee, are functional in any Canvas account where they are enabled.

[5nstewart23]

Thank you very much for your answer. Do you know how I would get a global developer key? 

[James]

 @5nstewart23  

You would need to contact Instructure to make this happen. I do not know who at Instructure, just a generic "Partnerships/Platform team" note from a document that may not be valid anymore.

Here's the process I went through to get that:

The Developer Key API documentation isn't helpful:

Root account administrators may enable or disable global developer keys for their specific account. This means that vendors who wish to have integrations that work in any Canvas account may request a global developer key from Instructure allowing account administrators enable the key for their account.

How do I manage developer keys for an account? says

Instructure does not review vendors prior to issuance of global developer keys, though specific vendor information is required. You should review your list of inherited keys to ensure that only institution-approved keys are active. To determine which developer keys are being used in your account, run the User Access Tokens report.

A week ago, a Canvas employee wrote that there would be more blogs and documentation generated in the coming months. Customer concerns about LTI Developer Key 

Administrative guidelines for issuing Canvas Developer Keys has a January 2019 update that links to a mostly still valid Administrative guidelines for managing Inherited Developer Keys, which has the best information I've been able to find so far.

It mentioned that it is managed by the Partnerships/Platform team. Here is a link to the partner website: Instructure | Instructure Partners that probably won't be helpful either.