Canvas LTI public-thread redaction checklist

Availability: Canvas integration is enabled per Organization by Alkimi, not something your campus administrators can switch on. If it is not available in your account, contact sales@alkimi.ai to discuss access.

Purpose

Use this checklist before posting a Canvas LTI setup or launch issue in a public forum topic. Public troubleshooting works well when a report carries the technical context needed to diagnose the problem while system credentials and student education records stay out of it. Run your draft past the two lists below, and sanitize or remove anything sensitive before you post.

What you can and cannot share

Safe to share in a public thread

Include as much of the following as applies to your LTI issue:

  • Canvas environment type, such as production, beta, or a named test instance
  • General Canvas base URL, provided it is publicly reachable
  • Alkimi environment name
  • LTI client ID
  • LTI deployment ID
  • Tool placement type, specifically course navigation
  • Sanitized issuer or audience value, provided it does not reveal a restricted environment
  • Timestamp with time zone showing when the issue occurred
  • Exact non-sensitive error message text
  • Browser name and version
  • Scope of impact, such as whether the issue affects one course or several courses
  • Redacted screenshots that display interface labels while hiding user names, tokens, and data

Keep out of a public thread

Remove every one of the following before you post, without exception:

  • Canvas developer key secrets
  • Private keys, JWKS private key material, PEM files, certificate keys, or signing material
  • Access tokens, ID tokens, refresh tokens, session tokens, cookies, or authorization headers
  • Full OIDC launch payloads or decoded JWT claims
  • Canvas API tokens
  • Screenshots displaying names, email addresses, SIS IDs, course rosters, grades, submissions, or file contents
  • Student or employee personal identifiers
  • Internal support links containing signed parameters
  • Full request headers that contain authorization or session values

Examples

A safe report

Below is an example of a properly sanitized report suitable for a public topic:

Environment: Canvas Production
Placement: Course navigation
Client ID: 10000000000123
Deployment ID: 1024:89201a3f
Timestamp: 2026-07-30 14:15:00 UTC
Observed error: OIDC state mismatch during launch initialization
Affected scope: Multiple courses across the College of Arts and Sciences

An unsafe report

Every line below carries something to strip before posting: credentials in the first three, student records in the last.

Authorization: Bearer 7~vN9kQ2xP4mL8zR1wY5tU3iO0aS6dF8gH2jK1lM
Developer Key Secret: secret_9876543210fedcba
Cookie: canvas_session=abc123xyz456secretcookie
Attached: screenshot_showing_full_biology_101_roster_and_grades.png

If you are unsure

If you are uncertain whether a parameter or log line is safe, replace the value with [redacted] and describe where it appeared. Platform administrators and support staff can request sensitive configuration details through an appropriate private support channel when deeper investigation is required.

Before you post

Before sharing prompts, configurations, or screenshots, review Community sharing and responsible AI use. Never post student records, personally identifiable information, or credentials.

Security reminder: keep private key material, tokens, and full request headers out of public topics. Report a suspected vulnerability to security@alkimi.ai rather than posting it.