{"record":{"id":"5f83416c4675dc1a","repo":"instructure/canvas-lms","slug":"tool-proxy-is-not-active","errorCode":null,"errorMessage":"Tool Proxy is not active","messagePattern":"Tool Proxy is not active","errorType":"exception","errorClass":"Lti::OAuth2::InvalidTokenError","httpStatus":401,"severity":"error","filePath":"app/controllers/lti/ims/access_token_helper.rb","lineNumber":78,"sourceCode":"    service = ims_tp.security_contract.tool_services.find(\n      lambda do\n        raise Lti::OAuth2::InvalidTokenError,\n              \"The ToolProxy security contract doesn't include #{service_names.join(\", or \")}\"\n      end\n    ) do |s|\n      service_names.include? s.service.split(\":\").last.split(\"#\").last\n    end\n    unless service.actions.map(&:downcase).include? request.method.downcase\n      msg = \"#{s.service.split(\":\").last.split(\"#\").last}.#{request.method} not included in ToolProxy security Contract\"\n      raise Lti::OAuth2::InvalidTokenError, msg\n    end\n  end\n\n  def developer_key\n    @_developer_key ||= access_token && begin\n      tp = Lti::ToolProxy.find_by(guid: access_token.sub)\n      if tp.present?\n        raise Lti::OAuth2::InvalidTokenError, \"Tool Proxy is not active\" if tp.workflow_state != \"active\"\n\n        validate_services!(tp)\n        tp.product_family.developer_key\n      else\n        DeveloperKey.find_cached(access_token.sub)\n      end\n    rescue ActiveRecord::RecordNotFound\n      nil\n    end\n  end\n\n  def lti2_service_name\n    raise \"the method #lti2_service_name must be defined in the class\"\n  end\n\n  def render_unauthorized\n    render json: { error: \"unauthorized\" }, status: :unauthorized\n  end","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/controllers/lti/ims/access_token_helper.rb#L60-L96","documentation":"Guard in Lti::IMS::AccessTokenHelper#developer_key: the ToolProxy identified by the access token's sub claim is not in an active state (workflow_state not active), so Lti::OAuth2::InvalidTokenError 'Tool Proxy is not active' is raised.","triggerScenarios":"Thrown at app/controllers/lti/ims/access_token_helper.rb:78 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-activate or re-register the ToolProxy for this account","Use credentials from an active tool proxy"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}