You may have noticed that we are updating how we handle User Access Tokens. These changes have been made across the September and October deploys. I wanted to walk through all of these changes together and how they will improve institutions’ security, particularly in light of increasing AI usage.
For all API keys, it is best practice to have a single, clear use that the API key be intended for. This ensures that you can identify which API user is doing what, and it also makes it easier to remove keys which are no longer needed. For this reason, we are requiring that User Access Tokens have a purpose set regardless of which user creates them.
To reduce the security risk in the scenario that a token is compromised, best practice is to have an expiration date on all User Access Tokens. That said, we are aware that some schools choose to use User Generated Access Tokens for long-lasting tools. As a compromise, we are requiring expirations for User Access Tokens which are created by users who have only student roles, and will be applying these to all previously created keys of users who only have student roles.
Most students who are using Canvas APIs for legitimate purposes are doing so as part of their coursework and learning. We intentionally set the maximum expiration date as 120 days as this is longer than most courses, so it should not interrupt the use of Tokens created for a specific course.
If a User Generated Access Token needs to be created for a longer period of time, this can be achieved by giving the user any role other than student (even with all permissions locked down). Our intention is to strike a balance between allowing administrators to choose what is best for their school and enable long-lived access as they feel is appropriate, while locking the system down enough that students aren’t enabling a key they don’t need (or worse, are using for unauthorized tools such as AI homework completion tools) on a long term basis.
As AI proliferates, we have seen an uptick in students setting up AI integrations to automatically review and complete assignments on their behalf. Our priority is to protect the integrity of the learning process, and these changes to User Access Tokens should help . We can also make it so that if misuse is discovered, an administrator can act swiftly to shut it down. In order to do this, we’ve made it so that from the user’s profile page as an administrator, you can see all User Generated Access Tokens for that user, view the purpose, and remove them if needed.
Some schools do not want anyone who isn’t an administrator to be able to offer API access into their Canvas instance. Some want instructors and TAs to have access to the APIs, but would like to prevent students from accessing them. We have made both of these options available on the account settings page. This allows each institution to choose the level of access they are comfortable with and have more control over user and institution data.
To interact with Panda Bot, our automated chatbot, you need to sign up or log in:
Sign in
