Registering a Tool

Before your LMS can launch a tool, the two systems have to be introduced. Registration is a two-way exchange: the vendor gives you some URLs and a key, and you give them some URLs and an ID.

You can register a tool from the LTIAAS Portal or through the Tools API. Both do the same thing.

What You Need from the Vendor

Ask the tool vendor for these. Most LTI® 1.3 tools publish them on a setup page.

Field	What it is
loginEndpoint	Their OIDC login initiation URL. LTIAAS posts here to start a launch.
launchEndpoint	Where launches should land by default.
deeplinkingEndpoint	Where deep linking launches land. Optional — falls back to launchEndpoint.
redirectionUris	Every URL the tool may be redirected back to. A launch aiming anywhere else is refused.
authConfig	How LTIAAS verifies messages the tool signs — usually a keyset URL.

Registering

curl -X POST https://your.ltiaas.com/admin/tools \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Tool",
    "loginEndpoint": "https://mytool.com/lti/login",
    "launchEndpoint": "https://mytool.com/lti/launch",
    "deeplinkingEndpoint": "https://mytool.com/lti/deeplink",
    "redirectionUris": ["https://mytool.com/lti/launch"],
    "authConfig": { "method": "JWK_SET", "key": "https://mytool.com/lti/keys" },
    "permissions": ["MEMBERSHIPS_READ", "LINEITEMS_READ"],
    "personalData": "COMPLETE",
    "active": true
  }'

note

Tool management lives under /admin, not /api. It uses the same API key.

LTIAAS responds with the registration, including three values it generated for you:

{
  "id": "3wT7bVhgsve6byG33fVV",
  "clientId": "3wT7bVhgsve6byG33fVV",
  "deploymentId": "EgAssgssdfgsfshshq8iw",
  "publicKey": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----\n",
  "...": "..."
}

The clientId is the value you will pass on every launch of this tool. It is always identical to id.

What You Give the Vendor

These are the registration settings for your platform. They are the same for every tool except clientId.

Setting	Value
Platform / Issuer URL	https://your.ltiaas.com
Client ID	The clientId from the registration response
Deployment ID	The deploymentId from the registration response
OIDC authentication endpoint	https://your.ltiaas.com/lti/authenticate
Access token endpoint	https://your.ltiaas.com/lti/authorize
Keyset (JWKS) URL	https://your.ltiaas.com/lti/keys

tip

Vendors label these differently — "authorization endpoint", "auth login URL", "platform OIDC endpoint" — but there are only ever three URLs plus an issuer and a client ID. If a form has a field you cannot place, the Platform Endpoints reference describes what each one does.

Choosing an Auth Method

authConfig.method tells LTIAAS how to check the tool's signatures.

Method	key holds	Use when
JWK_SET	A URL to the tool's JWKS	Almost always. The tool can rotate keys without telling you.
JWK_KEY	A single JWK, as a JSON string	The tool publishes one static key, no endpoint.
RSA_KEY	A PEM-encoded public key	The vendor sends you a .pem file.

Prefer JWK_SET. Static keys mean an outage the day the vendor rotates them.

Permissions

permissions controls which LTI® services this tool may use. A tool requesting a scope it was not granted is refused at the token endpoint.

Permission	Lets the tool
MEMBERSHIPS_READ	Read the course roster
LINEITEMS_READ	Read grade lines
LINEITEMS_READ_WRITE	Create, update and delete grade lines
GRADES_READ	Read learners' scores
GRADES_WRITE	Post scores

Grant only what the tool needs. A tool that just displays content needs none at all — send an empty array.

caution

A permission granted here still does nothing unless the matching service is enabled on your account in the portal. Both have to be on.

Privacy Level

personalData caps how much you can reveal about a user to this tool:

Value	Tool receives
NONE	No name, no email
EMAIL	Email only
NAME	Full, given and family name
COMPLETE	Name and email

LTIAAS enforces this when it builds the ID Token, so you can always send complete user records and let the setting do the filtering. It also applies to rosters returned through names and roles.

A single launch can lower or raise the level with the personalData field on the launch request — useful when one tool serves both anonymous and identified activities.

Custom Parameters

customParameters are key/value pairs sent to the tool on every launch. Individual launches can add their own; where both set the same key, the launch wins.

Managing Tools Afterwards

• List or fetch registrations
• Update one — every field is optional, and PUT and PATCH behave identically, so omitted fields keep their values
• Deactivate to stop launches while keeping the registration; activate to resume
• Delete to remove it and its keys permanently

tip

Reach for deactivate rather than delete when a contract lapses. Deleting destroys the tool's key pair, so re-registering later means the vendor has to reconfigure their side from scratch.

Next Steps

You now have a clientId. Your first launch puts it to work.