Agent Settings: LTI Keys

LTI panel in the Edit Agent modal on the Keys sub-tab, showing the LTI enable toggle, the Links, Keys, Tools and Tool Endpoints sub-tabs, a Create LTI Key button, and a table listing a key name with a truncated public key

Overview

The Keys sub-tab of the LTI panel manages the RSA key pairs used to sign LTI messages. The caption on this sub-tab explains: "Platform-wide RSA keys used to sign LTI messages. Select a key when creating an LTI tool." Keys are platform-wide — they belong to the organization, not to a single agent — and the same key list is visible from any agent's LTI panel.

In LTI 1.3, the tool signs its messages with a private key and the LMS verifies them against the matching public key (published via the JWKS endpoint). Each key created here holds that key pair; when you register an LTI tool on the Tools sub-tab, you select one of these keys as its signing key.

To reach this screen, open the Edit Agent modal, switch to the Integrations tab group (its sidebar lists Sandbox, Access, Tools, MCP, Datasets, API, LTI, and Embed), select LTI, and click the Keys sub-tab. The panel header reads: "Manage LTI agent links, signing keys, tools, and platform endpoints." The LTI panel is admin-only.

Target Audience

Administrator

Panel Reference

LTI enable toggle

The banner at the top of the LTI panel reads: "Let this agent be added to a Learning Management System (Canvas, Brightspace, Blackboard or Moodle) so students can open it right inside their course. When on, create the links, signing keys, and tools your LMS needs below." The toggle controls whether LTI launches are allowed for this agent — the same setting as Enable LTI launches in the agent's Settings. Creating LTI sub-resources requires it to be on.

Sub-tab bar

Four sub-tabs organize the LTI panel: Links (the launch link for this agent), Keys (this sub-tab), Tools (registered LMS platforms), and Tool Endpoints (the fixed URLs to give your LMS).

Create LTI Key

Opens a dialog to create a new signing key. You provide a name; the platform generates the RSA key pair. The new key then appears in the table and can be selected when creating an LTI tool.

Keys table

Each key is a row with:

NAME — the key's display name.
PUBLIC KEY — a truncated preview of the PEM-encoded public key (beginning -----BEGIN PUBLIC KEY-----).
ACTIONS — a menu per row. Edit opens the key detail, where you can rename the key and view its full PEM public key and its public JWK (the JSON Web Key form published at the JWKS endpoint). Delete removes the key after confirmation — note that a key cannot be deleted while an LTI tool still references it.

The list is paginated when there are many keys.

How to Use

Step 1: Open the Keys sub-tab

In the Edit Agent modal, go to Integrations → LTI and click Keys. Make sure the LTI toggle at the top of the panel is on.

Step 2: Create a key

Click Create LTI Key, give the key a recognizable name, and submit. The key appears in the table with a preview of its public key.

Step 3: Retrieve the public key when needed

Open the key's actions menu and choose Edit to view the full PEM public key and the public JWK. Most LMS registrations do not need these directly — the LMS fetches public keys from the organization's JWKS endpoint (see the Tool Endpoints sub-tab) — but they are available for platforms that require pasting a key.

Step 4: Use the key in a tool

Switch to the Tools sub-tab and create or edit an LTI tool; select this key as the tool's signing key so launches from that LMS are signed with it.

Step 5: Rename or delete

Use the row's actions menu to rename a key, or delete one that is no longer used. Delete the referencing tool first if the key is still attached to one.