LTI 1.3 setup for LMS administrators
What you need to connect your LMS, what data it shares with us, and what we send back.
- Last updated
- 2026-09-25
- Start a setup
- Contact us
What we support
- LTI 1.3 with the Advantage services that matter for a course: resource link launches, Deep Linking so instructors pick chapters and activities from inside the LMS, and Assignment and Grade Services so scores post back to your gradebook.
- Tested end to end against Moodle. Canvas, Blackboard Learn and D2L Brightspace follow the same standard. If yours is the first of its kind we set up, we do the first launch together with your administrator.
- We register every LMS by hand. Automatic (dynamic) registration is switched off, so nobody can connect an LMS to us without our knowledge.
Tool endpoints
| Setting | Value |
|---|---|
| OpenID Connect login (initiation) URL | https://www.questivaconsultants.com/lti/loginGET or POST |
| Launch / redirect URL | https://www.questivaconsultants.com/lti/launchAlso the target link URI |
| Deep linking URL | https://www.questivaconsultants.com/lti/deep-linkContent selection |
| Tool public key set (JWKS) | https://www.questivaconsultants.com/lti/jwksWe confirm your registration’s own key set URL |
| Canvas configuration (JSON) | https://www.questivaconsultants.com/lti/canvas.jsonPaste into a Canvas LTI key |
Setting it up
- Create an LTI 1.3 tool in your LMS using the endpoints above.
- Send us your issuer, client ID, deployment ID, and your platform’s key set, auth and token URLs, through the LMS setup form. Tell us which email domains your LMS uses for students.
- We register your platform and confirm the key set URL for your registration.
- An instructor adds a Questiva activity with Deep Linking, and we test one launch together.
What your LMS shares with us
- The LMS user ID, name and email, if your LMS is set to send them.
- The person’s course role (learner or instructor).
- The course ID and title, and which activity was launched.
An email sent by the LMS is only used to link to an existing Questiva account when it is on a domain you told us about, and never to link to a staff account. Otherwise the student gets an account tied to their LMS identity alone. You can withhold name and email in your LMS privacy settings; launches still work.
What we send back
Scores for the activities an instructor placed in the course, posted to your gradebook through Assignment and Grade Services. We don’t read or change anything else in your LMS.
Security of the launch
- Every launch token is verified against your platform’s published keys, and must name a registered issuer, client ID and deployment.
- Expired, future-dated and replayed tokens are refused, as is a launch that doesn’t match the browser that started it.
- Each registration has its own RSA key pair for the tool.
More on hosting, encryption and retention in the security overview.