LTI key defined, "Public JWK URL" never used

[lsloan]

I'd asked this question before, but it's probably more appropriate for this developers' forum.

I've configured an LTI key in Canvas with a URL in the "Public JWK URL" field.  After inspecting the traffic to my server, I see that Canvas never requests that URL.  However, the tool works fine.  How can this be?

[lsloan]

I've configured an LTI key in Canvas with a URL in the "Public JWK URL" field.  After inspecting the traffic to my server, I see that Canvas never requests that URL.  However, the tool works fine.  How can this be?

[matthew_buckett]

The JWK keys are only currently used for LTI Advantage services (eg Names and Roles Provisioning Service, https://canvas.instructure.com/doc/api/names_and_role.html), to just launch a tool you don't need a JWK key in your tool, just to validate the launch with the JWKs keys that Canvas is configured with ( eg https://canvas.instructure.com/api/lti/security/jwks )

[lsloan]

Thank you very much.  That makes sense.  I need to find some documentation of the LTI lifecycle.  I probably wouldn't have even asked this question if I knew which documentation to RTFM.  🙂