LTI® 1.3
LTI® 1.3 is the current major version of the standard. It replaced the shared-secret model of LTI® 1.1 with public key cryptography: the platform signs a JWT with a private key and the tool verifies it against a published key set.
A launch begins with an OIDC login initiation rather than a signed form post, and the payload arrives as an ID Token instead of form fields.
The practical consequence is that a tool no longer holds a secret per platform, and a compromised secret can no longer be replayed against every integration.
