LTI Launch Flow

LTI Launch Endpoints

These endpoints are called by the LMS during an LTI 1.3 launch. They are public endpoints and do not require an API key. The LMS redirects the student's browser to these URLs as part of the OIDC third-party login flow.

For a full walkthrough of the launch process, see the LTI Integration Guide.

GET /v1/platform/lti/login

OIDC login initiation endpoint. The LMS redirects the student's browser here to start the LTI launch. TutorFlow validates the parameters, generates a state and nonce, and redirects the browser back to the LMS authorization endpoint.

Query Parameters

Example

The LMS constructs a URL like this and redirects the student's browser to it:

https://api.tutorflow.io/v1/platform/lti/login
  ?iss=https://canvas.instructure.com
  &login_hint=user-id-12345
  &target_link_uri=https://api.tutorflow.io/v1/platform/lti/launch
  &lti_message_hint=assignment-context-hint
  &client_id=10000000000001

Response

This endpoint does not return a JSON body. It responds with an HTTP 302 redirect to the LMS authorization endpoint. The redirect URL includes the following query parameters:

Error Responses

POST /v1/platform/lti/launch

Launch callback endpoint. After the LMS authenticates the user, it POSTs a form to this URL containing the signed id_token (JWT) and the state value. TutorFlow validates the JWT signature, checks the state and nonce, extracts LTI claims, and creates a launch session.

Request Body (form-encoded)

Content Type

Content-Type: application/x-www-form-urlencoded

Example

The LMS auto-submits a form to this endpoint:

<form method="POST" action="https://api.tutorflow.io/v1/platform/lti/launch">
  <input type="hidden" name="id_token" value="eyJhbGciOiJSUzI1NiIs..." />
  <input type="hidden" name="state" value="csrf-state-token" />
</form>

JWT Claims

The id_token JWT contains standard LTI 1.3 claims:

Response

On success, TutorFlow creates an LTI launch session and redirects the student's browser to the tool UI. The response is an HTTP 302 redirect (or an HTML page rendered inside the LMS iframe).

Validation Steps

TutorFlow performs the following validation on every launch:

1. State check: The state parameter must match a valid, unexpired login session.
2. JWT signature: The id_token is verified against the LMS JWKS (fetched from the registered platformJwksUrl).
3. Issuer check: The iss claim must match the platformIssuer in the registration.
4. Audience check: The aud claim must include the registered clientId.
5. Nonce check: The nonce must match the value generated during the login step.
6. Expiry check: The token must not be expired (exp claim).
7. Message type: Must be a supported LTI message type.

Error Responses

GET /v1/platform/lti/.well-known/jwks.json

Returns TutorFlow's public JSON Web Key Set (JWKS). The LMS uses this endpoint to retrieve the public keys needed to verify JWTs signed by TutorFlow (used during deep linking responses and other tool-initiated messages).

Authentication

None. This is a public endpoint.

Example Request

curl https://api.tutorflow.io/v1/platform/lti/.well-known/jwks.json

Response

{
  "keys": [
    {
      "kty": "RSA",
      "kid": "tutorflow-lti-key-1",
      "use": "sig",
      "alg": "RS256",
      "n": "0vx7agoebGcQSuu...",
      "e": "AQAB"
    }
  ]
}

Response Fields

Caching

This endpoint supports HTTP caching. The response includes Cache-Control headers. Keys may be rotated periodically. LMS platforms should re-fetch the JWKS if JWT verification fails with a kid mismatch.