OAuth2 Access Token Endpoint

The OAuth2 token endpoint tools use to obtain an access token before calling the Names & Roles or Assignment & Grades services. You never call this — hand its URL to the tool vendor.

LTIAAS verifies the tool's signed client assertion against its registered authConfig, checks that every requested scope is in the tool's permissions, and issues a token valid for one hour.

application/x-www-form-urlencoded

Request Body required

grant_type string required

Possible values: [client_credentials]

client_assertion_type string required

Possible values: [urn:ietf:params:oauth:client-assertion-type:jwt-bearer]

client_assertion string required

A JWT signed by the tool. Its sub must be the tool's client ID and its aud must include https://your.ltiaas.com/lti/authorize.

scope string required

Space-separated list of requested LTI® service scope URLs.

Responses

Access token issued

application/json

Schema

Example (from schema)

Schema

access_token string

token_type string

scope string

Space-separated list of granted scope URLs.

expires_in integer

{
  "access_token": "string",
  "token_type": "bearer",
  "scope": "string",
  "expires_in": 3600
}

The request could not be completed.

application/json

Schema

Example (from schema)

Schema

status integer

error string

details object

Context for the failure. Always carries a message code; the other keys depend on what went wrong.

message string

description string

property name* any

Context for the failure. Always carries a message code; the other keys depend on what went wrong.

{
  "status": 403,
  "error": "Forbidden",
  "details": {
    "message": "INACTIVE_SERVICE",
    "description": "string"
  }
}

OAuth2 Access Token Endpoint​

OAuth2 Access Token Endpoint