Issuer

The issuer identifies the platform. It arrives on every launch as the iss claim of the ID Token, and it is one half of what identifies a registration — the other being the client ID.

It is usually a URL, but it is not required to be the platform's own address. Canvas commonly sends https://canvas.instructure.com even for institutions hosted on their own domain, so a registration keyed on the institution's hostname will never match its launches.

Because a tool may hold many registrations, and several institutions can present the same issuer, a registration must be looked up by issuer and client ID together. Matching on the issuer alone can hand one institution another's configuration.