In This Article:

• Overview
• How It Works
• Setup Order: Why It's Not One-Directional
• Setup
  • Step 1 (Genius): Get the Two URLs Canvas Needs
  • Step 2 (Canvas): Create the Developer Key
  • Step 3 (Genius): Finish the Registration
  • Step 4 (Canvas): Paste in the JWKS URL
• Day-to-Day Usage
• Troubleshooting
• Best Practices

Overview

Learning Tools Interoperability 1.3 is a Single Sign-On standard that lets Canvas launch directly into Genius without a separate Genius login. A learner (or instructor) clicks a link inside Canvas and lands signed into Genius automatically.

This is an additional way to connect Canvas to Genius. It runs alongside the existing Learning Tools Interoperability 1.1 connection method. If your organization already has Learning Tools Interoperability 1.1 configured, it continues to work unchanged. Learning Tools Interoperability 1.3 uses a more modern security standard (OpenID Connect with signed tokens) and some Canvas configurations require it going forward.

You'll configure both sides: a "registration" in Genius, and a matching Developer Key in Canvas. Each side needs something the other generates, so setup moves back and forth. See Setup Order before you start either side.

How It Works

At a high level:

1. A user clicks a Learning Tools Interoperability 1.3 link inside Canvas.
2. Canvas redirects the user's browser to Genius, carrying information about the launch.
3. Genius sends the user back to Canvas to confirm their identity via a signed security token.
4. Canvas returns that signed token to Genius.
5. Genius verifies the token, matches the user to a Genius account, and signs them in.

Users never see any of these steps — they click a link and land in Genius already signed in.

Matching Canvas users to Genius accounts

You choose, per registration, whether Genius matches users by Email or by Username. Email is the simpler option and works out of the box for most Canvas configurations. Username requires telling Genius which piece of information Canvas sends that corresponds to the Genius username (see Step 3 (Genius)).

Setup Order: Why It's Not One-Directional

Each system needs something only the other can generate, so you'll move between Genius and Canvas four times before setup is complete:

1. Start in Genius. Two values Canvas needs are already visible before you save anything.
2. Configure Canvas. This generates a Client ID and a Deployment ID — but one field can't be filled in yet.
3. Return to Genius to finish the registration. Saving generates a JWKS URL that doesn't exist until this step.
4. Go back to Canvas and paste the JWKS URL into the Public JWK URL field.

The steps below walk through each exchange in order.

Setup

Step 1 (Genius): Get the Two URLs Canvas Needs

Navigate to Administration → Integrations → LTI 1.3 Registrations.

Select New Registration. Don't fill anything in yet. The form immediately shows a Tool URLs card with a Login Initiation URL and Redirect URI, visible before you save or fill in anything else. These two URLs are fixed per Genius environment, not per registration.

Copy both URLs, then keep this tab open and proceed to Step 2. Nothing you'd enter here is saved until you submit the form. 

Step 2 (Canvas): Create the Developer Key

Whoever administers your Canvas instance handles this step (Canvas calls this role "Root Account Admin"). Steps below use Canvas's terminology as of when this article was written. Canvas may relabel fields over time.

1. In Canvas, go to Admin > Developer Keys.
2. Select + Developer Key > + LTI Key. This opens the Key Settings page.
3. Fill in the left column:
   • Key Name: a friendly label (e.g. "Genius"). Optional (placeholder shows "Unnamed Tool" if left blank).
   • Owner Email: optional, your contact information.
   • Redirect URIs (required): paste Genius's Redirect URI from Step 1. Must match exactly (casing, protocol, host, port, path, and query string).
   • Notes: optional, free text.
4. Under Configure, leave Method as Manual Entry, then fill in the required values:
   • Title (required): the tool's display name, shown to Canvas users (e.g. "Genius").
   • Description (required): a short description, shown in Canvas's app listing.
   • Target Link URI (required): the Genius destination this key launches to by default. Should match one of the Target URIs you'll enter on the Genius registration in Step 3.
   • OpenID Connect Initiation Url (required): paste Genius's Login Initiation URL from Step 1.
   • JWK Method (required): change from its default (Public JWK) to Public JWK URL. Leave the URL field blank for now — it doesn't exist until the Genius registration is saved in Step 3. You'll come back to fill it in during Step 4.
5. Expand Additional Settings. If your Genius registration uses Match Field: Email, set Privacy Level to Public. Without it, Canvas won't include the user's name or email in the launch, and Genius has nothing to match against — sign-in will silently fail.
6. Placements (required): choose at least one so the tool appears somewhere for users to launch from. Common options include Course Navigation, Global Navigation, Editor Button, Link Selection, and Assignment Selection. Each controls where the tool appears and how it launches in that context. Which placements fit your organization's intended use is a judgment call.

7. Save the key. It now appears on the Admin > Developer Keys list with a generated Client ID shown in the Details column. You'll need this in Step 3. 

8. Turn the key On using the toggle in the State column (Canvas Developer Keys are created disabled by default). Confirm in the dialog that appears.

Note: Canvas is migrating Learning Tools Interoperability tool management into a newer Canvas Apps interface (see the View in Canvas Apps link on the Developer Key row). The classic Developer Keys list still works as described here, but check whether your Canvas instance has fully moved install and placement management to Apps before following the next step. 

9. Install the tool: Admin > Settings > Apps (account-level) or a course's Settings > Apps tab, depending on whether you want this available account-wide or per-course. Installing it generates a Deployment ID. You'll need this in Step 3 as well. 

Note: Canvas supports multiple deployments of the same app under a single Client ID. Each deployment can have different placements, custom parameters, and availability settings. Each Genius registration points to one deployment. The Canvas Apps - Manage page (navigate to Admin > Apps, then select your app) shows all deployments, each marked Available or Not Available for its install context. Use the Deployment ID from the install marked Available for the context you want Genius reachable from. Copying the wrong one will silently fail to match any registration on the Genius side. 

You now have a Client ID and a Deployment ID. Proceed to Step 3. 

Step 3 (Genius): Finish the Registration

Return to the New Registration form in Genius and fill in the remaining fields:

Note: Only Client ID and Deployment ID come from Canvas. Issuer URL, Platform OIDC Auth URL, and Platform JWKS URL are standard Canvas endpoints — the same across every institution (not your institution's own Canvas subdomain):

Issuer URL: https://canvas.instructure.com

Platform OIDC Auth URL: https://canvas.instructure.com/api/lti/authorize_redirect

Platform JWKS URL: https://canvas.instructure.com/api/lti/security/jwks

If your Canvas instance is hosted in a different region or cloud environment, confirm these values still apply before using them.

Select Create Registration. 

After saving, the registration's detail page shows a Tool URLs section including the JWKS URL. This URL only exists now because it's tied to this registration's ID. Copy it and proceed to Step 4. 

(The Login Initiation URL and Redirect URI also appear here again - you already entered those into Canvas in Step 2.) 

Step 4 (Canvas): Paste in the JWKS URL

1. Open the installed app: Admin > Apps > {your app} > Configuration (or the classic Developer Keys edit screen — see the note in Step 2). The Launch Settings card shows the values you entered in Step 2.
2. Select Edit (or Edit as JSON), then paste the JWKS URL from Genius's registration detail page into the Public JWK URL field.
3. Save.

Both sides are now fully configured. 

Day-to-Day Usage

Once the registration is Active, launches run automatically. This section covers ongoing maintenance.

Enabling / Disabling a Registration

Navigate to Administration → Integrations → LTI 1.3 Registrations and open the registration you want to manage. Select Disable to immediately block all launches through that registration. Select Enable to restore it.

Troubleshooting

Best Practices

• Follow the setup steps in order. Start in Genius and copy the Login Initiation URL and Redirect URI before creating anything (Step 1); use those to create the Canvas Developer Key (Step 2); finish the Genius registration with the resulting Client ID and Deployment ID (Step 3); then paste the JWKS URL back into Canvas (Step 4). You'll move between both systems twice.
• Use a descriptive LMS Name for each registration. If your organization connects more than one Canvas instance (e.g. separate production and test), that field is for your reference only — a clear name makes it easier to manage multiple registrations.
• Disable rather than deleting a registration you want to pause. There is no delete action. Disabling is instant and reversible; it preserves all configuration so you can re-enable without starting over.
• Set placements to open in a new tab. Use "windowTarget": "_blank" via Configuration > Edit as JSON (see Step 2). This avoids the third-party-cookie session issue that an iframe-embedded launch can hit.