LTI 1.3 Integration Guide for Content Providers

Learning Tools Interoperability (LTI) is the standard that connects external tools and content to Learning Management Systems. If you are a content provider, training company, or platform that hosts learning content, LTI is one way to integrate deeply with customer LMS platforms — launching content, passing grades, and syncing rosters without custom API work for each LMS.

LTI 1.3, released by IMS Global (now 1EdTech), is a major overhaul of the protocol. This guide covers everything you need to know to implement it.

AllureConnect availability: this is an educational standards overview, not a current AllureConnect setup guide. AllureConnect does not expose LTI registration, login, JWKS, launch, Deep Linking, AGS, or NRPS endpoints today. LTI support is deferred.

Why LTI 1.3 Replaced LTI 1.1

LTI 1.1 used OAuth 1.0a for authentication — shared secrets, signature base strings, and HMAC-SHA1 signing. It worked, but it had significant security weaknesses:

• Shared secrets were often transmitted insecurely during setup.
• OAuth 1.0a signature validation was error-prone, leading to implementation bugs across LMS platforms.
• There was no standard way to make service calls back to the LMS (for grade passback, roster sync, etc.) beyond basic outcomes.

LTI 1.3 replaces all of this with modern security standards:

• OAuth 2.0 for service-to-service authentication.
• JSON Web Tokens (JWTs) for message signing and verification.
• Public/private key pairs instead of shared secrets. Keys are published via JWKS (JSON Web Key Set) endpoints.
• OpenID Connect for the launch flow, providing a well-understood, battle-tested authentication pattern.

Key Concepts

Platform and Tool

In LTI terminology, the Platform is the LMS (Moodle, Canvas, Blackboard, etc.) and the Tool is the external application. The Platform initiates launches, and the Tool receives them and serves content.

Deployment

A deployment represents a specific installation of a Tool within a Platform. One Tool can have multiple deployments across different Platform instances. Each deployment has its own configuration: client ID, deployment ID, and associated key pairs.

Message Types

LTI 1.3 defines several message types. The two most important are:

• LtiResourceLinkRequest— the standard launch message. The Platform sends the learner to the Tool with context about who they are, what course they are in, and what resource they are launching.
• LtiDeepLinkingRequest— used when an instructor wants to browse and select content from the Tool to embed in their course.

The LTI 1.3 Launch Flow

An LTI 1.3 launch follows the OpenID Connect third-party login flow:

1. Platform initiates login: the Platform sends a POST or GET request to the Tool’s login_url with parameters including iss (issuer), login_hint, target_link_uri, and an optional lti_message_hint.
2. Tool redirects to auth endpoint: the Tool validates the request, generates a state and nonce, and redirects the browser to the Platform’s authorization endpoint with an OpenID Connect authentication request.
3. Platform returns ID token: the Platform authenticates the user, creates a signed JWT (the ID token) containing LTI claims (user identity, course context, resource link, roles), and POSTs it back to the Tool’s redirect_uri.
4. Tool validates and launches: the Tool verifies the JWT signature using the Platform’s JWKS endpoint, checks the nonce and state, extracts the LTI claims, and serves the appropriate content.

Deep Linking

Deep Linking lets instructors browse a catalog of content from the Tool without leaving their LMS. When the Platform sends an LtiDeepLinkingRequest, the Tool presents a content picker UI. The instructor selects one or more resources, and the Tool returns LtiDeepLinkingResponse messages containing resource links that the Platform embeds in the course.

An LTI-capable content tool can use this flow to let instructors browse hosted packages and add a selected resource to their LMS course. AllureConnect does not provide this content-picker flow today.

Assignment and Grade Services (AGS)

AGS is the LTI 1.3 service that replaces the old Basic Outcomes service. It allows the Tool to:

• Create line items(grade columns) in the Platform’s gradebook.
• Post scores for individual learners, including numeric grades, activity progress, and completion status.
• Read existing scores to avoid overwriting manual grade adjustments.

AllureConnect does not currently implement AGS grade passback. A future LTI implementation would need to ship and document that service before customers can rely on it.

AllureConnect Registration Status

There is no supported AllureConnect LTI registration flow today. Do not create an LMS tool registration with guessed or placeholder URLs. A real implementation would need all of the following documented by the Tool provider:

• Real HTTPS login, launch, and JWKS endpoints.
• Client and deployment identifiers plus supported scopes.
• A documented key-rotation and token-validation policy.
• LMS-specific conformance testing for every claimed Platform.

Names and Roles Provisioning Service (NRPS)

NRPS allows an LTI Tool to request a list of users enrolled in a course from the Platform. A Tool can use it to:

• Pre-populate learner records before content is launched.
• Show instructors a roster view with completion status for each student.
• Sync role information (student, instructor, TA) for access control.

NRPS is an optional LTI 1.3 service — not all Platforms support it. When available, it eliminates the need for manual CSV imports or SCIM provisioning.

Security Considerations

• Always validate JWT signaturesagainst the Platform’s JWKS endpoint. Never skip signature verification, even in development.
• Check the nonceto prevent replay attacks. Store used nonces for at least the token’s lifetime.
• Require HTTPS for all endpoints. LTI 1.3 transmits authentication tokens and personal data; unencrypted transport is unacceptable.
• Validate the issuer and audience claims in every JWT. A token from one Platform must not be accepted for another.
• Rotate keys periodically. Publish new keys in your JWKS endpoint before retiring old ones to avoid service disruption.

LTI 1.3 vs Content Dispatch: When to Use Which

AllureConnect supports content dispatch today. The LTI column below is included to help teams identify when their requirements exceed the current product:

Use content dispatch for the current AllureConnect workflow. If LTI 1.3, Deep Linking, AGS, or NRPS is a hard requirement, use an LTI-capable provider until AllureConnect publishes a shipped, documented implementation.