OIDC Authentication Endpoint

The OIDC authorization endpoint that registered tools call to begin a launch. You never call this — hand its URL to the tool vendor as the authentication or authorization endpoint.

LTIAAS validates the tool's request, then 302-redirects the browser to the Launch URL or Deep Linking URL you configured in the portal, with a signed payload query parameter. Verifying that payload and answering with an ID Token is your part of the flow.

Both GET and POST are accepted; parameters may arrive in the query string or the form body.

note

This endpoint is unauthenticated by design. It is protected by the tool's registered redirect URIs, a signed message hint, and a 30-second nonce replay window.

Query Parameters

client_id string required

The tool's client ID, issued by LTIAAS at registration.

login_hint string required

Echoed back from the launch — the user value you supplied.

lti_message_hint string required

The signed launch token issued by Create Launch Parameters. Expires one hour after issue.

redirect_uri uri required

Must match one of the tool's registered redirectionUris.

scope string required

Possible values: [openid]

Must be openid.

response_type string required

Possible values: [id_token]

Must be id_token.

response_mode string required

Possible values: [form_post]

Must be form_post.

prompt string required

Possible values: [none]

Must be none.

state string required

Opaque value the tool uses to correlate the response.

nonce string required

Single-use value. Reusing one within 30 seconds fails with DUPLICATE_NONCE.

Responses

• 302
• 400
• 403
• 404

---

Redirect to your configured Launch URL or Deep Linking URL, carrying ?payload=<JWT>.

One or more request parameters were missing or malformed.

application/json

Schema

Example (from schema)

---

Schema

status integer
error string
details object
errors object[]
One entry per field that failed validation.
Array [
field string
message string
]

{
  "status": 400,
  "error": "Bad Request",
  "details": {
    "errors": [
      {
        "field": "clientId",
        "message": "Missing 'clientId' parameter."
      }
    ]
  }
}

The account is not permitted to use this endpoint — most often because it is an LTIAAS Launch account rather than a Connect one, or because a trial quota has been reached.

application/json

Schema

Example (from schema)

Example

---

Schema

status integer
error string
details object

Context for the failure. Always carries a message code; the other keys depend on what went wrong.

message string

description string

property name* any

Context for the failure. Always carries a message code; the other keys depend on what went wrong.

{
  "status": 403,
  "error": "Forbidden",
  "details": {
    "message": "INACTIVE_SERVICE",
    "description": "string"
  }
}

{
  "status": 403,
  "error": "Forbidden",
  "details": {
    "message": "INVALID_ACCOUNT_TYPE"
  }
}

No tool with that ID is registered on this account.

application/json

Schema

Example (from schema)

Example

---

Schema

status integer
error string
details object

Context for the failure. Always carries a message code; the other keys depend on what went wrong.

message string

description string

property name* any

Context for the failure. Always carries a message code; the other keys depend on what went wrong.

{
  "status": 403,
  "error": "Forbidden",
  "details": {
    "message": "INACTIVE_SERVICE",
    "description": "string"
  }
}

{
  "status": 404,
  "error": "Not Found",
  "details": {
    "message": "UNREGISTERED_TOOL"
  }
}

Loading...