Technical Reference
Standards
| LTI 1.3 / LTI Advantage | LTI 1.1 | |
|---|---|---|
| Launch | OIDC third-party login + signed id_token (RS256) |
basic-lti-launch-request, OAuth 1.0a HMAC-SHA1 or HMAC-SHA256 |
| Content selection | Deep Linking 2.0 (LtiDeepLinkingRequest → signed LtiDeepLinkingResponse with ltiResourceLink + lineItem) |
Per-link URL …/lti/{test,quiz,assessment}/<id>/ or custom parameter test=, quiz= or assessment=<id> |
| Grades | Assignment and Grade Services — POST to <lineitem>/scores (application/vnd.ims.lis.v1.score+json), OAuth2 client-credentials with a signed JWT assertion |
Basic Outcomes replaceResult, OAuth 1.0a signed with oauth_body_hash |
| Roster (NRPS) | not used | — |
Endpoints
| Path | Method | Purpose |
|---|---|---|
/tasks/lti/login/ |
GET, POST | LTI 1.3 OIDC login initiation |
/tasks/lti/launch/ |
POST | LTI 1.3 redirect URI (all LTI 1.3 launches, including Deep Linking) |
/tasks/lti/jwks/ |
GET | Tool public keys (JWKS) |
/lti/config.json |
GET | LTI 1.3 tool configuration (Canvas "Enter URL" format) |
/lti/home/, /lti/deep-link/ |
— | LTI 1.3 target link URIs |
/lti/launch/ |
POST | LTI 1.1 launch (optional ?test=, ?quiz= or ?assessment=<id>) |
/lti/test/<id>/, /lti/quiz/<id>/, /lti/assessment/<id>/ |
POST | LTI 1.1 launch of one item |
/lti/config/ |
GET | LTI 1.1 cartridge XML |
/lti/manage/ |
GET, POST | Organization administrators: keys, registrations, test links, deliveries |
Launch validation
LTI 1.3
- state and nonce are single-use, stored server-side, valid for 10 minutes.
- id_token checks: RS256 signature against the platform keyset (refetched once if the kid is unknown), iss, aud (and azp when several audiences), exp/iat (60 s leeway), nonce, version = 1.3.0, message type, and deployment_id when deployment IDs are registered.
- Registrations are matched on issuer and client ID (issuer alone only when exactly one registration uses it).
LTI 1.1
- RFC 5849 signature over all POST parameters and any query-string parameters, constant-time comparison.
- oauth_timestamp within 5 minutes; each oauth_nonce accepted once per consumer.
- lti_message_type must be basic-lti-launch-request.
Identity
- Users are keyed on (LMS registration, LMS user id —
sub/user_id). - On first launch, an existing account is linked by email only when it is active, not PrepareBuddy staff, and has no active membership in another organization; otherwise the launch stops with an explanatory message. New accounts have no password until the user sets one.
- Users become
members of the registration's organization. LMS roles (Instructor, TeachingAssistant, ContentDeveloper, Mentor, Administrator) decide whether PrepareBuddy shows the teacher view; they never grant PrepareBuddy roles.
Launch flow
The launch response is a small page the LMS may frame (Content-Security-Policy: frame-ancestors *). It opens a one-time sign-in URL (valid 10 minutes, single use) in a top-level tab — automatically when the LMS already opened a new window. Signing in first-party avoids third-party-cookie restrictions in current browsers.
For a student, a link uses the student's own assignment of the linked item in the organization — a LanguageTestAssignment (one per LMS link), their existing ReusableExamAssignment for a quiz, or their AssessmentAssignment — creating it on first launch. That assignment's score goes to the launch's gradebook column. Opening the link again returns to the same assignment.
Grade delivery
- Queued after the result is committed; never sent from inside the student's request.
- Sent immediately on a background thread, retried on HTTP 5xx / 429 / 401 / timeouts with backoff (1, 2, 4, 8, 16, 32, 60, 60 minutes; 8 tries). LTI 1.1
codeMajorfailures and other 4xx responses are recorded as failed and can be resent. - Triggers: language test completion/regrade (held results on release); quiz assignment completed; assessment feedback released to the student (
sent_to_student). A score is re-sent only if it changed.
Data kept
Per launch: LMS user id, email and name as sent, course and link ids and titles, roles, grade endpoint (outcome URL + sourcedid, or line item URL). Per grade: score, maximum, status, attempts, LMS HTTP status and reply. Nonces and login states are purged after a day.