The Instructure Community will enter a read-only state on November 22, 2025 as we prepare to migrate to our new Community platform in early December. Read our blog post for more info about this change.
You may have noticed that we are updating how we handle User Access Tokens. These changes have been made across the September and October deploys. I wanted to walk through all of these changes together and how they will improve institutions’ security, particularly in light of increasing AI usage.
- All User Generated Access Tokens require that a purpose be set. (Deployed October 8, 2025)
For all API keys, it is best practice to have a single, clear use that the API key be intended for. This ensures that you can identify which API user is doing what, and it also makes it easier to remove keys which are no longer needed. For this reason, we are requiring that User Access Tokens have a purpose set regardless of which user creates them.
- User Generated Access Tokens created by users with only student roles must have an expiration date no more than 120 days away. (Deployed October 8, 2025)
To reduce the security risk in the scenario that a token is compromised, best practice is to have an expiration date on all User Access Tokens. That said, we are aware that some schools choose to use User Generated Access Tokens for long-lasting tools. As a compromise, we are requiring expirations for User Access Tokens which are created by users who have only student roles, and will be applying these to all previously created keys of users who only have student roles.
Most students who are using Canvas APIs for legitimate purposes are doing so as part of their coursework and learning. We intentionally set the maximum expiration date as 120 days as this is longer than most courses, so it should not interrupt the use of Tokens created for a specific course.
If a User Generated Access Token needs to be created for a longer period of time, this can be achieved by giving the user any role other than student (even with all permissions locked down). Our intention is to strike a balance between allowing administrators to choose what is best for their school and enable long-lived access as they feel is appropriate, while locking the system down enough that students aren’t enabling a key they don’t need (or worse, are using for unauthorized tools such as AI homework completion tools) on a long term basis.
- Administrators can see and remove user generated User Access Tokens from a user’s profile. (Deployed October 8, 2025)
As AI proliferates, we have seen an uptick in students setting up AI integrations to automatically review and complete assignments on their behalf. Our priority is to protect the integrity of the learning process, and these changes to User Access Tokens should help . We can also make it so that if misuse is discovered, an administrator can act swiftly to shut it down. In order to do this, we’ve made it so that from the user’s profile page as an administrator, you can see all User Generated Access Tokens for that user, view the purpose, and remove them if needed.
- Administrators can prevent all non-admins or all students from generating User Access Tokens. (Deployed September 10, 2025)
Some schools do not want anyone who isn’t an administrator to be able to offer API access into their Canvas instance. Some want instructors and TAs to have access to the APIs, but would like to prevent students from accessing them. We have made both of these options available on the account settings page. This allows each institution to choose the level of access they are comfortable with and have more control over user and institution data.
27 Comments
Community help
To interact with Panda Bot, our automated chatbot, you need to sign up or log in:
Sign in