Hi Samuel,
I am doing the same thing here, we have an app and we integrate it to be usable by some educational institutions,
The key and secret those are values you are responsible to provide your customer with, for example you have to have an end point where some developer or who's taking care of canvas in this institution will . go to and generate them on your platform, and you save it in your database.
When you will receive the request it will has the value of this key and the oauth signature, you validate this signature using the key and look up the secret from you database using this key.
I wish that can help you out, but if you have more question feel free to ask.