Yes for now, any use of the general Canvas REST API outside of the LTI services (names and roles provision and assignments and grades) you'll need to get a separate token via OAuth (separate Developer Key) for this to work.
At some point in the future we'll merge the two types of Developer Keys so app integrators only have to maintain one set of keys and ease what Canvas admins have to evaluate and monitor for access.
Yes for now, any use of the general Canvas REST API outside of the LTI services (names and roles provision and assignments and grades) you'll need to get a separate token via OAuth (separate Developer Key) for this to work.
At some point in the future we'll merge the two types of Developer Keys so app integrators only have to maintain one set of keys and ease what Canvas admins have to evaluate and monitor for access.
For demonstration purposes, I have built LTI tools that have a given user's access token built into them to enable the LTI tool to use the Canvas REST API to get information. This works well, but requires that you check who is making the LTI tool call to see if they should be permitted to perform the subsequent REST API accesses.
