Connect Canvas

This guide is for Canvas administrators connecting their institution to Alexandria. It assumes you know the Canvas admin interface, but not that you work with LTI daily.

Setup takes about five minutes.

Before you start: two different keys

Canvas uses the phrase “Developer Key” for two unrelated things, and conflating them is the most common source of failed setups. You will create both, for different reasons, at different points in this guide.

	LTI Key	API Key
Canvas calls it	Developer Key → + LTI Registration	Developer Key → + API Key
What it does	Lets users launch Alexandria and proves who they are	Lets Alexandria read course content and rosters
Created in	Step 1	Step 4
Required?	Yes, always	Yes, for course and material sync
You give us	Nothing, it is negotiated automatically	The client ID and secret

If you create only the LTI key, launches work but Alexandria cannot pull in course materials. If you create only the API key, nothing launches at all.

Step 1: Create the LTI key

Alexandria supports Dynamic Registration, so you paste one URL rather than filling in a JSON configuration by hand.

1. Go to Admin → Developer Keys.

2. Click + Developer Key and choose + LTI Registration.

   Enlarge

   + LTI Registration is the dynamic registration path. + LTI Key is the manual one, and + API Key is the separate credential from step 4.

3. A Register App dialog opens with a single Dynamic Registration Url field. Paste:

   https://production-backend.libraryofalexandria.nl/lti/register

4. Click Continue and follow the prompts to finish the registration.

5. On the Developer Keys list, switch the new key’s state to ON.

New keys are created OFF

Canvas creates developer keys in the OFF state and gives no warning about it. A key left off will not launch. This is worth checking first whenever a Canvas setup appears to have completed successfully but nothing works.

Enlarge

A working key: the client ID under Details, and the State toggle green.

What gets configured for you

• Placement: Alexandria appears in Course Navigation, enabled by default.
• Launch behaviour: opens in a new window, set automatically. This matters because Alexandria signs users in through a secure cookie exchange that browsers only permit in a top-level tab.
• Privacy level: email_only. Canvas sends us the user’s name and email, nothing further.
• Custom field: canvas_course_id, so we can tell which course a launch came from.

If your policy forbids dynamic registration

Use this only if you have to. Choose + LTI Key instead of + LTI Registration, set Method to Paste JSON, and paste the configuration we send you into the LTI 1.3 Configuration box.

Enlarge

The manual path. Ask us for the configuration JSON rather than writing it yourself.

Use Paste JSON, not Manual Entry. Retyping the configuration by hand tends to lose the new-window launch behaviour and the email_only privacy level, and neither omission is visible until someone tries to launch.

Step 2: Make it visible in courses

The Course Navigation placement is enabled by default, so Alexandria should appear in the left-hand course menu once the key is on.

Enlarge

Installed once at account level, the app is locked in every course and needs no per-course install.

Individual educators can still hide it per course under Settings → Navigation. If a lecturer reports that Alexandria has vanished from one course while working elsewhere, check there before assuming the integration is broken.

To see what the registration actually asked for, open Admin → Apps, switch to the Manage tab, click Alexandria, and open Configuration. Three things are worth reading there: Permissions, which for Alexandria is empty, Data Sharing, which reports the privacy level, and Placements, which lists every part of Canvas the app can appear in.

Enlarge

Course Navigation is the only placement, and the privacy level is the user's email only. Nothing else is requested.

Enlarge

What educators and students see: Alexandria in the course menu. Clicking it opens Alexandria in a new tab.

Step 3: Decide which courses it applies to

Installing the app is a decision about your whole account. Scoping it is the decision your institution will actually deliberate over, because a three-course pilot and a faculty-wide rollout are the same installation with different exception lists.

Canvas now keeps all of this under Admin → Apps. The Developer Keys page carries a notice saying that LTI tool management has moved and that Apps is the primary home for LTI tools, with changes syncing between the two pages.

The deployment registers itself

Open Admin → Apps → Manage and click Install a New App. Canvas asks for an LTI version and an Install Method, and the method list offers Dynamic Registration, Enter URL, JSON, and Manual. Only the first needs nothing but a URL.

Enlarge

Dynamic Registration asks for one URL. There is no field for a key, a secret, or a deployment ID.

Canvas mints the client ID and the deployment ID itself and shows both afterwards: the app’s header carries a Copy Client ID button, and its Availability and Exceptions tab prints the Deployment ID for the account it is installed in. You never type a key, and you never send us one. Alexandria accepts new deployment IDs from a registration it already trusts, so a second deployment needs no message to us either.

Availability and exceptions

The Availability and Exceptions tab shows the account the app is installed in, its current availability, and the exceptions that sit under it. Each row counts what it covers, so you can see at a glance how wide the current scope is.

Enlarge

The account row sets the default. Exceptions below it override that default for one sub-account or one course.

Add Exception opens a search over your sub-accounts and courses. Pick as many as the decision needs, set each one to Available or Not Available, and save.

Enlarge

An exception you have just added defaults to Not Available.

Which way round you work depends on the size of the rollout:

• A pilot. Set the account row to Not Available and add an Available exception for each participating course or for the sub-account that holds them.
• A faculty-wide or institution-wide rollout. Leave the account row Available and add Not Available exceptions only where Alexandria must not appear.

Canvas tells you when an exception is pointless: an exception whose availability matches the level above it is labelled as inheriting the parent’s availability and having no effect. That label is a useful check that you scoped the thing you meant to scope.

A new exception defaults to Not Available

Adding a course to the exception list and saving without touching the dropdown removes access for that course. It does not grant it. When you are building a pilot list, set each row to Available before saving, then reopen the tab and confirm the badges read the way you expect.

Turn App Off, in the app header, is a different control. It switches the whole installation off rather than narrowing it, and it is not the way to run a pilot.

Step 4: Create the API key for course sync

This is the second credential from the table above. It lets Alexandria read course content and enrolments, so educators do not have to upload materials by hand.

1. Go to Admin → Developer Keys → + Developer Key → + API Key.

2. Give it a recognisable name, for example Alexandria Course Sync.

3. Set the Redirect URI to:

   https://app.libraryofalexandria.nl/oauthresponse

4. If Enforce Scopes is switched on, grant read access to courses, modules, pages, files, enrolments, and users. If it is off, no scope selection is needed.

5. Save the key and switch its state to ON.

6. Copy the client ID and secret, and paste both into the Alexandria setup screen shown at the end of registration.

Send the secret through the Alexandria setup form rather than by email.

Step 5: Institution verification

If your Canvas runs on your institution’s own domain, for example canvas.your-university.nl: Alexandria verifies the institution automatically and the connection goes live immediately.

If it runs on a shared Instructure address that does not identify your institution, a person reviews the registration first. We ask for a contact name and email during setup, and confirm within one working day.

What educators and students see

The first educator to launch Alexandria from a course is taken to a setup page where they link the Canvas course to Alexandria and choose which materials the AI may use. This takes a few minutes and happens once per course.

A student who launches a course the educator has not set up yet sees a page explaining that the course is not ready and asking them to check back.

Course copies and new terms

Canvas gives a copied course a new course ID. Alexandria reads the course from the launch every time, rather than remembering it against the link, so a copy is treated as a new course: the educator is walked through setup again, and students see the “not ready yet” page until that is done.

Launches never break, and they never silently serve the previous term’s materials.

Troubleshooting

Canvas-specific problems are below. For issues common to every LMS, see Troubleshooting LTI launches.

Alexandria does not appear in the course menu. The developer key is still OFF, or the educator has hidden it under Settings → Navigation.

Alexandria appears in some courses but not others. An exception is scoping it away. Check Admin → Apps → Manage → Alexandria → Availability and Exceptions, and remember that a course sitting under a sub-account marked Not Available is excluded even though nothing names that course. See step 3.

Launches work but no course materials appear. The LTI key is in place and the API key is not, or the API key’s state is OFF. See step 4.

The tool opens a blank frame. Rare on Canvas, since the new-window setting is applied automatically, but it can happen if the placement was edited by hand after registration. Restore the display type to new_window.

Data and privacy

• Received per launch: issuer, a stable user identifier, email address, LTI role, and Canvas course ID.
• Received via the API key: course content, materials, and enrolment lists for the courses educators choose to connect.
• Hosting: processed and stored in the EU on Google Cloud. Encrypted in transit (TLS 1.2 and above) and at rest (AES-256).

Full detail is in the Trust Center and the privacy policy.