Configuring Your Account
Everything on this page lives in the LTIAAS Portal, under your account's API Settings. You only need to do it once.
Your Subdomain
Every account gets its own domain, and it is the base URL for every call you make:
https://your.ltiaas.com
It is also the LTI® issuer — the identity tools know your platform by. Custom domains are supported if you would rather use your own.
Your API Key
The API key authenticates every request you make to LTIAAS. It goes in an Authorization header as a bearer token:
Authorization: Bearer df06d55e-3b0f-4121-b60f-c39469b5b550
There is one key per account, and it grants full access, so treat it as a secret: keep it in your server's environment, never in front-end code, and rotate it from the portal if it is ever exposed.
The Three Target URLs
Connect hands work back to you at three URLs. All three are endpoints on your own server, and you set them in the portal.
Launch URL
Where LTIAAS sends the browser during step 3 of a launch. It receives a GET with a ?payload=<JWT> query parameter, and it answers with the form returned by Complete Launch Form.
https://yourlms.com/lti-validate
This one is required — without it, no launch can finish.
Deep Linking URL
The same idea, for deep linking launches. This is the page a teacher sees while choosing content from a tool, so it typically renders some UI of yours around the tool's picker.
https://yourlms.com/lti-deep-linking
Required only if you enable deep linking.
Service URL
A single POST endpoint that receives every service request — roster reads, grade writes, deep linking results. One endpoint handles all of them; you branch on the type claim inside the payload.
https://yourlms.com/lti-services
Required only if you enable deep linking, names and roles, or assignment and grades.
All three can be the same host, or even the same server framework — they are just three routes. Keep them separate from your regular API routes so their authentication (JWT verification rather than a session cookie) stays obvious to whoever reads the code next.
Your Consumer Public Key
LTIAAS signs the payload it sends to your Launch, Deep Linking and Service URLs with an RSA key belonging to your account. Copy the public half from the portal and store it in your server's environment:
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
-----END PUBLIC KEY-----
Every request that arrives from LTIAAS must be verified against this key before you act on it. See Authenticating API requests.
This is a different key from the ones at https://your.ltiaas.com/lti/keys. Those are per-tool keys that tools use to verify your ID Tokens. This one is your account key, used only to sign requests to you.
Enabling Services
Deep linking, names and roles, and assignment and grades are enabled per account in the portal. A launch that uses a disabled service is refused with 403 INACTIVE_SERVICE, so switch on the ones you intend to support before testing.
Enabling a service at the account level makes it available; each tool then gets its own permissions controlling whether it may actually use it.
Next Steps
Register your first tool and you have everything a launch needs.
