instructure/canvas-lms · error · Lti::OAuth2::InvalidTokenError

Tool Proxy is not active

Error message

Tool Proxy is not active

What it means

Guard in Lti::IMS::AccessTokenHelper#developer_key: the ToolProxy identified by the access token's sub claim is not in an active state (workflow_state not active), so Lti::OAuth2::InvalidTokenError 'Tool Proxy is not active' is raised.

Solutions

1. Re-activate or re-register the ToolProxy for this account
2. Use credentials from an active tool proxy

When it happens

Trigger: Thrown at app/controllers/lti/ims/access_token_helper.rb:78 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/5f83416c4675dc1a. Report an issue: GitHub.

Appendix: source

Thrown at app/controllers/lti/ims/access_token_helper.rb:78

    service = ims_tp.security_contract.tool_services.find(
      lambda do
        raise Lti::OAuth2::InvalidTokenError,
              "The ToolProxy security contract doesn't include #{service_names.join(", or ")}"
      end
    ) do |s|
      service_names.include? s.service.split(":").last.split("#").last
    end
    unless service.actions.map(&:downcase).include? request.method.downcase
      msg = "#{s.service.split(":").last.split("#").last}.#{request.method} not included in ToolProxy security Contract"
      raise Lti::OAuth2::InvalidTokenError, msg
    end
  end

  def developer_key
    @_developer_key ||= access_token && begin
      tp = Lti::ToolProxy.find_by(guid: access_token.sub)
      if tp.present?
        raise Lti::OAuth2::InvalidTokenError, "Tool Proxy is not active" if tp.workflow_state != "active"

        validate_services!(tp)
        tp.product_family.developer_key
      else
        DeveloperKey.find_cached(access_token.sub)
      end
    rescue ActiveRecord::RecordNotFound
      nil
    end
  end

  def lti2_service_name
    raise "the method #lti2_service_name must be defined in the class"
  end

  def render_unauthorized
    render json: { error: "unauthorized" }, status: :unauthorized
  end

View on GitHub (pinned to 1c9f0bb801)