Adding a Developers Key-Access in Canvas?

[nicole_klues]

Hi, All! 

We have never added a developer's key and wanted to know what the company will be able to access once I set up the key? The co. will be working on building an API for teachers to quickly toggle from Canvas to their platform with SSO.  Basically, concerned about protection of student data. Also, should I give this key in the test environment?  Sounds like the best plan, but wanted to be sure. 

Thanks  @lane_worrall ​ for your help today!

Thanks all-new to this process.

Cheers,

Nicole K.

[lane_worrall]

Hi nicole.klues

After some additional searching, I found this thread that explains a little more about what a developer key does exactly: Developer key or data access token?​  erinhallmark provides a helpful answer there.  It looks like  @RobDitto ​ encountered a similar request for a Developer key from a 3rd party vendor.  I think it's totally reasonable for you to ask the developers of your custom LTI tool to provide you with the specifics of how their tool would use your developer key.

I also wanted to direct you to  @mlewis23 ​ awesome LTI tool, Threadz.  The ReadMe file on Matt's github page for Threadz​, offers a very clear overview of the steps you will probably go through to install an external LTI tool into your Canvas instance.  Although the instructions are specific to the Threadz tool, I think the overall process will be very similar.   @mlewis23 ​, feel free to correct me if I'm off base here! ​

[kfeldt]

As one speaking from the development side, you really should avoid allowing the developer to 'develop' against live student data. The options are to have a second 'staging' site that hosts canvas as a testing area (this is site from which you'd assign the developer key). Another option is to have the developer install their own version of canvas where they could do their testing and conduct demonstrations to show you their progress.

Your complication is in the 'toggling' between platforms - as this toggling may, by design, open student access to the alternate LMS may require the 'second' LMS to get student data by design.

So while complicated (and not easy), I strongly suggest that early-stage development and testing be outside of your production student data, and that some type of specification be provided by the vendor which fully describes (to the point where you have a comfortable understanding) of what specific data will be accessed, and what the access rights are (who gets to see the data).

Good luck!