Connect Canvas

This guide covers the full Canvas setup, in the order the screens have to be completed. Everything you need is on this page. Setup takes about fifteen minutes.

Work through the steps in order. Step 2 asks for the client ID and secret that step 1 produces, so starting at step 2 does not work.

What you are setting up

Canvas uses the phrase “Developer Key” for two unrelated things, and conflating them is the most common cause of a failed setup. You will create both.

	API Key	LTI Key
Canvas calls it	Developer Key → + API Key	Developer Key → + LTI Registration
What it does	Lets Odea read course content and rosters	Lets users launch Odea and proves who they are
Created in	Step 1	Step 2
You give us	The client ID and secret	Nothing, it is negotiated automatically

With only the LTI key, launches work but no course materials import. With only the API key, nothing launches at all.

Enlarge

Both credentials sit on the same menu. + API Key is step 1; + LTI Registration and + LTI Key are two routes to step 2.

Step 1: Create the API key

This produces the client ID and secret that step 2 asks for.

The redirect URI

After a user approves access, Canvas sends the browser back to Odea. The redirect URI must match what you register character for character:

https://odea.education/oauthresponse

No www prefix

Odea is at odea.education. Requests to www.odea.education are redirected to the non-www host, but OAuth providers compare redirect URIs literally, and www fails the comparison. Register https://odea.education/oauthresponse exactly as written.

Create the key

1. Go to Admin → Developer Keys → + Developer Key → + API Key.

2. Set Key Name to something you will recognise later, for example Odea Course Sync.

3. Set Redirect URI to the URL above.

4. If Enforce Scopes is on, paste every scope below into the scope picker. Spelling and parameter names must match Canvas exactly. If Enforce Scopes is off, leave scopes empty.

   url:GET|/api/v1/users/:id url:GET|/api/v1/courses url:GET|/api/v1/courses/:id url:GET|/api/v1/courses/:course_id/modules url:GET|/api/v1/courses/:course_id/modules/:module_id/items url:GET|/api/v1/courses/:course_id/pages url:GET|/api/v1/courses/:course_id/pages/:url_or_id url:GET|/api/v1/courses/:course_id/files url:GET|/api/v1/files/:id url:GET|/api/v1/courses/:course_id/enrollments url:GET|/api/v1/courses/:course_id/users url:POST|/api/v1/courses/:course_id/modules url:POST|/api/v1/courses/:course_id/modules/:module_id/items url:PUT|/api/v1/courses/:course_id/modules/:id

   These cover reading courses, modules, pages, files, enrolments and users. The three write scopes cover optional module publishing, when an educator exports content back to Canvas.

5. Save the key, then switch its state to ON on the Developer Keys list. New keys are created OFF, and a key left off cannot authorize API calls.

6. Copy the client ID and secret from the key details. The secret cannot be read again after you leave the page.

Before you start step 2

• I have the client ID
• I have the client secret
• The key's state is ON
• The redirect URI is registered exactly as written

Step 2 asks for the client ID and secret partway through the registration dialog. There is no way to supply them beforehand, and no way to complete the registration without them.

Send the secret through Odea, not by email

Paste the secret into the registration dialog, or later into Admin dashboard → Settings. Do not send it to us by email or chat.

Step 2: Create the LTI key

Canvas keeps LTI tools under Admin → Apps. The older Admin → Developer Keys page still works and carries a notice saying Apps is now the primary home for LTI tools. The two pages sync, so a tool installed on one appears on the other.

There are two routes to the LTI key.

Dynamic registration

Recommended. You paste one URL and a dialog walks you through the rest. Canvas and Odea agree every endpoint, key and claim between themselves. No JSON.

1. Go to Admin → Apps → Manage and click Install a New App.

2. In the Install App dialog, set Select LTI Version to 1.3 and Install Method to Dynamic Registration.

3. Paste this into Dynamic Registration URL:

   https://production-backend.odea.education/lti/register

   Enlarge

   Dynamic Registration asks for one URL. There is no field for a key, a secret or a deployment ID.

4. Click Next and follow the prompts.

5. When Odea’s dialog asks for them, paste the client ID and secret from step 1.

6. Go to Admin → Developer Keys and switch the new key’s state to ON.

New keys are created OFF

Canvas creates developer keys in the OFF state and gives no warning. A key left off will not launch. Check this first whenever a Canvas setup appears to have completed but nothing works.

Enlarge

A working key: the client ID under Details, and the State toggle green.

What the dialog sets for you. None of this is entered by hand:

• Placement: Odea appears in Course Navigation, enabled by default.
• Launch behaviour: opens in a new window. Odea signs users in through a secure cookie exchange that browsers only permit in a top-level tab.
• Privacy level: email_only. Canvas sends the user’s email address and nothing further.
• Custom field: canvas_course_id, so a launch can be matched to its course.

No LTI credential is sent to us. Canvas mints the client ID and the deployment ID itself and shows both afterwards: the app header carries a Copy Client ID button, and its Availability and Exceptions tab prints the Deployment ID. Odea accepts new deployment IDs from a registration it already trusts, so a second deployment needs no message either.

Manual (Paste JSON)

Use this route only if institutional policy forbids dynamic registration. It reaches the same place, but nothing is negotiated: every setting the registration would have agreed is one you now own, and a wrong one is invisible until someone tries to launch.

1. Go to Admin → Developer Keys.

2. Click + Developer Key and choose + LTI Key, not + LTI Registration.

3. Set Method to Paste JSON.

4. Paste this configuration into the LTI 1.3 Configuration box, exactly as written:

   {
     "title": "Odea",
     "description": "Launch Odea courses from Canvas using LTI 1.3.",
     "oidc_initiation_url": "https://production-backend.odea.education/lti/login",
     "target_link_uri": "https://production-backend.odea.education/lti/launch",
     "scopes": [],
     "extensions": [
       {
         "domain": "odea.education",
         "tool_id": "alexandria",
         "platform": "canvas.instructure.com",
         "privacy_level": "email_only",
         "settings": {
           "text": "Odea",
           "icon_url": "https://odea.education/favicon.svg",
           "placements": [
             {
               "text": "Odea",
               "icon_url": "https://odea.education/favicon.svg",
               "placement": "course_navigation",
               "message_type": "LtiResourceLinkRequest",
               "target_link_uri": "https://production-backend.odea.education/lti/launch",
               "windowTarget": "_blank",
               "custom_fields": {
                 "canvas_course_id": "$Canvas.course.id"
               }
             }
           ]
         }
       }
     ],
     "public_jwk_url": "https://production-backend.odea.education/lti/jwks",
     "custom_fields": {
       "canvas_course_id": "$Canvas.course.id"
     }
   }

   Enlarge

   The manual path. Paste the configuration above rather than retyping it field by field.

5. Save, then switch the new key’s state to ON on the Developer Keys list.

6. Email [email protected] with the client ID shown under Details. The connection cannot be completed without it.

7. Enter the API key’s client ID and secret from step 1 under Admin dashboard → Settings once your institution has been approved.

Two lines in that configuration are the ones most often lost, and both fail silently:

• "windowTarget": "_blank" opens Odea in a new tab. Without it Canvas loads Odea in an iframe, where browsers block the sign-in cookie and the frame stays blank.
• "privacy_level": "email_only" sends the user’s email. Canvas defaults to anonymous, which strips the email and leaves the launching user unidentifiable.

Paste JSON, never Manual Entry

Retyping the configuration by hand tends to lose the new-window launch behaviour and the email_only privacy level. Neither omission is visible until someone tries to launch.

Step 3: Make it visible in courses

The Course Navigation placement is enabled by default, so Odea appears in the left-hand course menu once the key is on.

Enlarge

Installed once at account level, the app is locked in every course and needs no per-course install.

Educators can still hide it per course under Settings → Navigation. If a lecturer reports that Odea has vanished from one course but works elsewhere, check there before assuming the integration is broken.

To see what the registration asked for, open Admin → Apps, switch to the Manage tab, click Odea, and open Configuration. Three sections matter: Permissions, which for Odea is empty, Data Sharing, which reports the privacy level, and Placements, which lists every part of Canvas the app can appear in.

Enlarge

Course Navigation is the only placement, and the privacy level is the user's email only. Nothing else is requested.

Enlarge

What educators and students see: Odea in the course menu. Clicking it opens Odea in a new tab.

Step 4: Decide which courses it applies to

Installing the app is an account-wide decision. Scoping it is where a three-course pilot and a faculty-wide rollout differ: same installation, different exception lists.

Open Admin → Apps → Manage, click Odea, and go to Availability and Exceptions.

The tab shows the account the app is installed in, its current availability, and the exceptions beneath it. Each row counts what it covers.

Enlarge

The account row sets the default. Exceptions below it override that default for one sub-account or one course.

Add Exception opens a search over your sub-accounts and courses. Pick as many as the decision needs, set each to Available or Not Available, and save.

Enlarge

An exception you have just added defaults to Not Available.

Which way round you work depends on the size of the rollout:

• A pilot. Set the account row to Not Available and add an Available exception for each participating course, or for the sub-account holding them.
• A faculty-wide or institution-wide rollout. Leave the account row Available and add Not Available exceptions only where Odea must not appear.

Canvas labels an exception whose availability matches the level above it as inheriting the parent’s availability and having no effect. That label is a useful check that you scoped the thing you meant to scope.

A new exception defaults to Not Available

Adding a course to the exception list and saving without touching the dropdown removes access for that course. It does not grant it. When building a pilot list, set each row to Available before saving, then reopen the tab and confirm the badges read as expected.

Turn App Off, in the app header, is a different control. It switches the whole installation off rather than narrowing it, and it is not the way to run a pilot.

Step 5: Institution verification

If your Canvas runs on your institution’s own domain, for example canvas.your-university.nl, the institution is verified automatically and the connection goes live immediately.

If it runs on a shared Instructure address that does not identify your institution, a person reviews the registration first. Odea asks for a contact name and email during setup, and we confirm within one working day.

What educators and students see

The first educator to launch Odea from a course reaches a setup page, where they link the Canvas course to Odea and choose which materials the AI may use. This takes a few minutes and happens once per course.

A student who launches a course the educator has not set up yet sees a page explaining that the course is not ready.

Course copies and new terms

Canvas gives a copied course a new course ID. Odea resolves the course from the launch every time rather than binding it to the link, so a copy is treated as a new course: the educator is walked through setup again, and students see the “not ready yet” page until that is done.

Launches never break, and they never silently serve the previous term’s materials.

Troubleshooting

Canvas-specific problems are below. For issues common to every LMS, see Troubleshooting LTI launches.

Odea does not appear in the course menu. The developer key is still OFF, or the educator has hidden it under Settings → Navigation.

Odea appears in some courses but not others. An exception is scoping it away. Check Admin → Apps → Manage → Odea → Availability and Exceptions. A course under a sub-account marked Not Available is excluded even though nothing names that course. See step 4.

Launches work, but no course materials appear. The API key is missing, its state is OFF, or its credentials were never entered. See step 1, then Admin dashboard → Settings.

The OAuth consent screen reports an invalid redirect URI. The URI registered in step 1 differs from the one Odea sends, usually by a www prefix or a trailing slash.

The tool opens a blank frame. Rare on Canvas, since the new-window setting is applied automatically, but it can happen if the placement was edited by hand after registration. Restore the display type to new_window.

Data and privacy

• Received per launch: issuer, a stable user identifier, email address, LTI role and Canvas course ID.
• Received through the API key: course content, materials and enrolment lists, for the courses educators choose to connect.
• Hosting: processed and stored in the EU on Google Cloud. Encrypted in transit (TLS 1.2 and above) and at rest (AES-256).

Full detail is in the Trust Center and the privacy policy.