Introduction to LTIAAS Connect
LTIAAS Connect lets your learning management system launch third-party LTI® 1.3 tools. You make ordinary REST calls; LTIAAS performs the protocol work — the OIDC handshake, the JWT signing and verification, the OAuth2 token issuing, and the service proxying — as an LTI® platform acting on your behalf.
The practical effect is that adding LTI® support to an LMS becomes a handful of HTTP calls rather than a standards implementation project. You never generate a key pair, never sign a JWT, and never read the specification.
Connect or Launch?
LTIAAS has two products, and they sit on opposite ends of the same protocol. Picking the wrong one is the most common false start, so it is worth being deliberate:
| LTIAAS Connect | LTIAAS Launch | |
|---|---|---|
| You are building | A learning management system | A learning tool |
| LTIAAS acts as | The LTI® platform (consumer) | The LTI® tool (provider) |
| Launches are | Started by you, into someone else's tool | Sent to you, by someone else's LMS |
| You provide | A roster, grades, and course context | An activity for learners to use |
If teachers add your content to their Canvas or Moodle course, you want LTIAAS Launch. If teachers add other people's content to courses inside your platform, you want Connect.
An LTIAAS account is either a Connect account or a Launch account — never both. Calling a Connect endpoint with a Launch account's API key fails with 403 INVALID_ACCOUNT_TYPE, and vice versa. If you need both, you need two accounts.
What LTIAAS Handles, and What You Handle
Connect draws a clean line down the middle of an LTI® integration.
LTIAAS handles the protocol. It maintains a key pair for every registered tool, publishes a public keyset, answers the tool's OIDC authorization requests, mints and signs ID Tokens, issues OAuth2 access tokens, validates every inbound message, and enforces the privacy level and service permissions you set on each tool.
You handle everything that is specific to your LMS. Only your system knows who the user is, which course they are in, whether they are a teacher or a learner, what the roster looks like, and where grades belong. Connect asks you those questions at the moments it needs answers, and you reply.
That division is why a Connect integration has two halves: endpoints you call, and requests you answer.
The Three Surfaces
Before writing any code, it helps to know which endpoints are which.
Endpoints you call. Launch, ID Token and Tools are plain REST endpoints on your LTIAAS subdomain, authenticated with your API key. These are what you write code against.
Endpoints the tool calls. The platform endpoints — authentication, access token, keyset, deep linking return, and the service endpoints — are the LTI® interface LTIAAS exposes to registered tools. You never call them. You hand their URLs to the tool vendor when you register the tool.
Requests LTIAAS makes to you. When a tool asks for a course roster or writes a grade, LTIAAS forwards that request to a single Service URL on your server as a signed JWT. Your server answers it. These are the service requests.
A first integration only needs surfaces 1 and 2. Service requests are needed once you support tools that read rosters or write grades, and you can add them later without changing anything you have already built.
Section Summary
📄️ How a Launch Works
The four steps of an LTIAAS Connect launch, and which side is responsible for each.
📄️ Configuring Your Account
The URLs, API key and public key that a Connect integration depends on.
📄️ Registering a Tool
Register a third-party LTI® tool and exchange settings with its vendor.
Next Steps
Read How a launch works for the shape of the flow, then configure your account and register your first tool. When you are ready to write code, Your first launch walks through a complete working integration.
