{"record":{"id":"405bb11861226b85","repo":"instructure/canvas-lms","slug":"developer-key-is-not-active-or-available-in-this-environment","errorCode":null,"errorMessage":"Developer Key is not active or available in this environment","messagePattern":"Developer Key is not active or available in this environment","errorType":"exception","errorClass":"Lti::OAuth2::InvalidTokenError","httpStatus":401,"severity":"error","filePath":"app/controllers/lti/ims/access_token_helper.rb","lineNumber":30,"sourceCode":"# Canvas is distributed in the hope that it will be useful, but WITHOUT ANY\n# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR\n# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more\n# details.\n#\n# You should have received a copy of the GNU Affero General Public License along\n# with this program. If not, see <http://www.gnu.org/licenses/>.\n\nmodule Lti::IMS::AccessTokenHelper\n  def authorized_lti2_tool\n    validate_access_token!\n    true\n  rescue Lti::OAuth2::InvalidTokenError\n    render_unauthorized_action\n  end\n\n  def validate_access_token!\n    access_token.validate!\n    raise Lti::OAuth2::InvalidTokenError \"Developer Key is not active or available in this environment\" if developer_key && !developer_key.usable?\n  rescue Lti::OAuth2::InvalidTokenError\n    raise\n  rescue => e\n    raise Lti::OAuth2::InvalidTokenError, e\n  end\n\n  def access_token\n    @_access_token ||= begin\n      access_token = AuthenticationMethods.access_token(request)\n      access_token && Lti::OAuth2::AccessToken.from_jwt(\n        aud: request.host,\n        jwt: access_token\n      )\n    end\n  end\n\n  def oauth2_request?\n    pattern = /^Bearer /","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/controllers/lti/ims/access_token_helper.rb#L12-L48","documentation":"Guard in Lti::IMS::AccessTokenHelper#validate_access_token!: the presented LTI 2 access token's developer key is inactive or unavailable in this environment (e.g. not activated, wrong shard/environment), so Lti::OAuth2::InvalidTokenError is raised and the caller renders 401.","triggerScenarios":"Thrown at app/controllers/lti/ims/access_token_helper.rb:30 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Activate the developer key for this environment/account","Request a fresh access token bound to an active key instead of a stale one"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}