Deliver

LTI 1.3 setup

Connect Scormbusters to Canvas, Moodle or Blackboard as an LTI 1.3 tool: registration, keys, launch flow, learner provisioning, and AGS grade passback to the LMS gradebook.

Last reviewed October 5, 2026

Scormbusters supports LTI 1.3 launches, which means learners can launch courses directly from Canvas, Moodle, Blackboard, or any LTI 1.3-compliant LMS without creating a separate Scormbusters account.

On the hosted service, LTI delivery is an Enterprise plan feature: every LTI launch serves the learner from Scormbusters' infrastructure, so it is priced with learner volume in mind. SCORM and HTML5 export reach any LMS on every plan.

Verified end to end against Canvas and Moodle 5.2.3 (5 October 2026): OIDC login, signed launch, automatic learner provisioning, and grade passback (Assignment and Grade Services) — passing and failing scores, with the failure's comment, arrive in each gradebook; on Canvas both as an assignment and as a module item. The Canvas run used Instructure's open-source canvas-lms. The runs are automated (npm run probe:canvas:lti, probe:moodle:lti, and a strict spec check against saLTIre), so they are repeated rather than remembered. LTI stays beta until Blackboard is tested. Deep Linking is not implemented.

Table of contents

1. How it works
2. Step 1 — Register your LMS in Scormbusters
3. Step 2 — Register Scormbusters in your LMS - Canvas - Moodle - Blackboard
4. Step 3 — Add a course link in your LMS
5. What learners experience
6. Grades and completion
7. Troubleshooting

How it works

LTI 1.3 is an industry standard for embedding learning tools inside an LMS. The flow:

1. Learner clicks a course link inside Canvas (or Moodle, etc.)
2. The LMS sends a signed JWT to Scormbusters' launch endpoint
3. Scormbusters verifies the JWT, looks up or creates the learner's account, and redirects them to the course player
4. Progress, scores and completion are recorded in Scormbusters, and — when the platform offered AGS in the launch — the final score is posted back to the LMS gradebook on completion

No separate login. No password. The learner's LMS session carries through.

Step 1 — Register your LMS in Scormbusters

Settings → LTI Integration (owner only)

You'll need the following values from your LMS (collected in Step 2):

After saving, Scormbusters shows you three values to configure in your LMS:

Copy the JWKS URL exactly as Settings → LTI Integration shows it — it carries your organization's id. Keys are served per organization, so the bare /api/lti/jwks returns an empty key set and the LMS will reject every grade passback. Registering a platform also creates your organization's signing key if it does not have one yet. | Redirect URI | https://yourdomain.com/api/lti/launch |

Step 2 — Register Scormbusters in your LMS

Canvas

1. Admin → Developer Keys → + Developer Key → LTI Key
2. Configure: - Key Name: Scormbusters (or your preferred label) - Redirect URIs: https://yourdomain.com/api/lti/launch - Method: Manual Entry - Title: Scormbusters - Target Link URI: https://yourdomain.com/api/lti/launch - OpenID Connect Initiation URL: https://yourdomain.com/api/lti/login - JWK Method: Public JWK URL → https://yourdomain.com/api/lti/jwks?orgId=<your-org-id> - LTI Advantage Services: enable "Can retrieve user data", "Can create and view assignment data in the gradebook"
3. Save, then toggle the key to On
4. Copy the Client ID (numeric value shown in the key list)
5. Admin → Settings → Apps → View App Configurations → + App - Configuration Type: By Client ID - Client ID: paste the value from step 4
6. Note the Deployment ID shown after installation

Now go back to Scormbusters Settings → LTI Integration and fill in:

• Issuer: https://canvas.instructure.com — the same for every Instructure-hosted Canvas, whatever your school's domain. Not your institution's URL: Canvas does not send it, and the launch will fail with "Platform not found".
• Client ID: from step 4
• JWKS URL: https://sso.canvaslms.com/api/lti/security/jwks
• Auth endpoint: https://sso.canvaslms.com/api/lti/authorize_redirect
• Token endpoint: https://sso.canvaslms.com/login/oauth2/token
• Deployment ID: from step 6

Instructure moved these three endpoints from canvas.instructure.com to sso.canvaslms.com; the old domain still answers for now, but Instructure has said it will stop. Canvas's beta and test environments are separate platforms with their own values — issuer https://canvas.beta.instructure.com / https://canvas.test.instructure.com and endpoints on sso.beta.canvaslms.com / sso.test.canvaslms.com — so register each environment you launch from as its own platform (the Client ID is shared). Self-hosted Canvas uses whatever issuer and domain its operator configured.

For grade passback, add Scormbusters to a course as an assignment (Canvas then names the gradebook column in the launch) or as a module item (Scormbusters finds or creates its own column, which needs the line item scope).

Moodle

1. Site Administration → Plugins → External tool → Manage tools → Configure a tool manually
2. Configure: - Tool URL: https://yourdomain.com/api/lti/launch - LTI version: LTI 1.3 - Client ID: leave blank (Moodle generates one) - Public keyset URL: https://yourdomain.com/api/lti/jwks?orgId=<your-org-id> - Initiate login URL: https://yourdomain.com/api/lti/login - Redirect URI: https://yourdomain.com/api/lti/launch
3. Save. Moodle will display a Client ID and configuration details.
4. Copy the Moodle-provided values back into Scormbusters Settings → LTI Integration: - Issuer: your Moodle URL, e.g. https://moodle.yourschool.edu - Client ID: from step 3 - JWKS URL: https://moodle.yourschool.edu/mod/lti/certs.php - Auth endpoint: https://moodle.yourschool.edu/mod/lti/auth.php - Token endpoint: https://moodle.yourschool.edu/mod/lti/token.php - Deployment ID: shown in Moodle tool configuration

Blackboard

Blackboard registers tools centrally: the tool is an application on Blackboard's developer portal, and each Blackboard site installs it by that application's ID. Blackboard checks grade passback against the key set the application lists — and Scormbusters' keys are per workspace — so each workspace registers its own (free) application:

1. At developer.blackboard.com, register an application with your values from Settings → LTI Integration: - Login Initiation URL: https://yourdomain.com/api/lti/login - Tool Redirect URL(s): https://yourdomain.com/api/lti/launch - Tool JWKS URL: https://yourdomain.com/api/lti/jwks?orgId=<your-org-id> - Signing algorithm RS256. Note the Application ID.
2. In Blackboard Learn: **System Admin → Integrations → LTI Tool Providers → Register LTI 1.3/Advantage Tool**, paste the Application ID as the Client ID, and save. Blackboard shows a Deployment ID — copy it. Allow the tool to send user name and email, and enable grade service access (Assignment and Grade Services) so scores can post back.
3. In Scormbusters, add the platform: - Issuer: https://blackboard.com — the same for every Blackboard site - Client ID: the Application ID - Auth Login URL: https://developer.blackboard.com/api/v1/gateway/oidcauth - Auth Token URL: https://developer.blackboard.com/api/v1/gateway/oauth2/jwttoken - JWKS URL: https://developer.blackboard.com/api/v1/management/applications/<Application ID>/jwks.json - Deployment ID: from step 2 — required: every Blackboard site shares the issuer, so the deployment ID is what routes launches to your workspace.

Blackboard has not yet been verified against a live Blackboard Learn site; its published keys are confirmed to load in Scormbusters' verifier.

Step 3 — Add a course link in your LMS

Once the tool is registered, instructors add an activity that tells Scormbusters which course to open, via the custom parameter the launch route reads:

course_id=<course UUID>

Canvas: Add an External Tool assignment or module item, select Scormbusters, and add course_id=<uuid> under Custom Fields on the tool configuration (or per-assignment custom parameters).

Moodle: Add an External Tool activity, select Scormbusters, and put course_id=<uuid> in the activity's Custom parameters box.

The course UUID is shown in the course editor URL (/courses/<uuid>/edit). If no course_id is sent, Scormbusters falls back to the LMS resource link id, which usually will not match a course — always set it.

What learners experience

1. Learner clicks the course link in their LMS
2. They are silently authenticated — no Scormbusters login screen
3. They complete the course in the Scormbusters player
4. Their progress and score are recorded in Scormbusters' analytics and reports

First-time learners get a Scormbusters account created automatically, linked to their LMS identity (not to their email address — an LMS-claimed email is never used to sign in to an existing Scormbusters account).

Embedded (iframe) launches depend on third-party cookies. Safari and some privacy-hardened browsers block them, in which case the learner sees a Scormbusters login screen inside the frame. Configure the LMS activity to open in a new tab or window if your learners hit this.

Grades and completion

Grade passback (LTI Advantage Assignment and Grade Services) is implemented. When the platform includes the lti-ags endpoint claim in the launch token (in Moodle: enable *IMS LTI Assignment and Grade Services* in the tool's Services; in Canvas: scopes are granted by the developer key), Scormbusters stores the offer at launch and, when the learner finishes the course, posts a score to the gradebook:

• scoreGiven / scoreMaximum — the final percentage out of 100 (omitted for unscored courses, which still report completion)
• activityProgress: Completed, gradingProgress: FullyGraded
• posted with an OAuth2 client-credentials token obtained via a signed JWT assertion (the same org key your JWKS endpoint publishes)

If the launch names a specific line item it is used; otherwise Scormbusters finds or creates one for the resource link (this needs the lineitem scope, not just score). Scores also remain in Scormbusters' own Analytics regardless. Launches without the AGS claim behave exactly as before — nothing is posted.

Troubleshooting

"No active session found" error on launch The OIDC login → launch flow didn't complete correctly. Check that your Login URL (/api/lti/login) and Redirect URI (/api/lti/launch) match exactly what's registered in the LMS — including the protocol (https://).

"Platform not found" error The iss (issuer) and client_id in the JWT don't match any registered platform in Scormbusters. Verify the Issuer field in Settings → LTI Integration matches what the LMS sends exactly.

"Nonce already used" or "Nonce expired" LTI nonces expire after 10 minutes and are single-use. This usually means the launch is being replayed (e.g., a cached page). Ensure the launch URL is not being cached.

JWT signature verification failed Scormbusters fetches the LMS's public keys from the JWKS URL to verify launch JWTs. Check that the JWKS URL is reachable from your Scormbusters server. If you're running locally, the LMS may not be able to reach your dev server.