Canvas access tokens

Canvas LMS provides many features via its comprehensive REST API that allow the accessing and modifying of data externally. To protect sensitive operations, many of these API calls require user identification in the form of an access token. A token is essentially the equivalent of a user’s username and password, that grant access to Canvas LMS with the same permission levels as the user the token belongs to.

A token is the equivalent of your username and password. DO NOT, share, publish or otherwise compromise the security of your token.

For comprehensive information about access tokens in Canvas LMS, review the access tokens - Canvas REST API documentation .

Request a token

Tokens are controlled, and you must make an application to Teaching and Learning Innovation. Please use ServiceNow to submit your request. Your request must include:

• The reason why you require access and,
• The period of time required.

All tokens will be set by default to expire at the end of the calendar year. Tokens will not be granted for longer than 12 months. Should you require an extension, please request this prior to the token expiry. A new token can be requested at any time.

Activate a token

Once your ServiceNow request has been processed and a token provided, it will not be active until the user activates the token.

To activate a token, navigate to Settings in your Canvas LMS user profile, and click activate. The token page will not auto-refresh, but the token will be active immediately.

Disable/remove a token

When you have finished with your token, or it has expired, you may delete it from your profile.

Navigate to Settings in your Canvas LMS user profile, navigate to the token and click the delete icon. Your token will be deleted. Any further API calls using the token will be rejected.