Canvas OAuth 2 error unauthorised client - Client does not have access to the specified Canvas account

[ted123]

Hello, we're trying to integrate our application to a canvas account via OAuth2 workflow but we're receiving this particular error response: 

error=unauthorized_client&error_description=Client+does+not+have+access+to+the+specified+Canvas+account

but we're only receiving this error for this new client we had with their specific instructure subdomain. We previously had implemented it for other canvas accounts on other instructure subdomains and it worked well using our generated developer key (client id and client secret). This is the first time we've encountered this issue with our developer key. I'm really not sure what's causing the issue, is it possible for a canvas admin to block a client id? or is this a misconfiguration on their end? 

[chriscas]

Hi @ted123,

Generally, the admins for each Canvas instance will create a developer key for each app, and this key would be unique to their specific Canvas instance.  There are some "inherited" keys which somehow get created at a higher level (I do not know the process for that), but admins would need to go into their instance and enable the specific inherited key for it to be used with their Canvas instance.  Is the key you're speaking about configured by Instructure as an inherited key, or does that terminology sound familiar to you at all?  I'm a Canvas admin for my institution, and I'm having a bit of trouble deciphering what you said, so this is my best guess.  if you could give us any more details or screenshots, that might be really helpful!

-Chris

[ted123]

Thank you so much for responding @chriscas ! We're indeed using an inherited key and I think your guess is correct. I was assuming the whole time that the key we're using will just work without other configuration. So an admin of a canvas instance needs to manually enable it in order for our client id to work in their oauth 2 workflow. I'll reach out to our client about this and see if they've enabled our inherited key and post the outcomes here for future reference. Thanks again @chriscas !     

[chriscas]

Exactly right!  There is some info about inherited keys for admins at How do I manage developer keys for an account? - Instructure Community - 249 (canvaslms.com) and Administrative guidelines for managing Inherited D... - Instructure Community - 269029 (canvaslms.co... if a school/institution needs further clarity.

Hopefully this is the answer and gets things working for you!

-Chris