API Tokens

What is an API Token?

An API token, also known as an access token, is a unique string used to authenticate and authorize a user or application to access a restricted resource or API (Application Programming Interface). It acts like a digital key, allowing secure interaction with the API without exposing sensitive credentials such as usernames or passwords. API tokens are commonly used to allow scripts, applications, and other services to interact with Canvas.

Risks of Sharing Tokens

API tokens are powerful credentials and should be handled carefully. Sharing a token with an unapproved application or third party can create significant security risks. In Canvas, an API token may allow an application to access account and course data or perform actions based on the permissions of the user who generated the token. If a token or application is compromised, it could be used to access sensitive information, send messages, alter data, or otherwise interact with Canvas on the user's behalf.

Faculty and staff who require a token may request one using the form below. Students are not eligible to receive Canvas API tokens. Teaching assistants may request a token only with approval from the instructor of record for the course in which the token will be used.

User-generated Canvas API tokens are limited to a maximum of 90 days and cannot be extended. Users who need continued access must submit a new request before their existing token expires. Any scripts, tools, or workflows that depend on a token may stop working when the token expires. Active tokens may also be revoked due to changes in roles, security requirements, or policy.

Applications intended for ongoing or broader institutional use may require review through the formal learning tool review process. Individual or locally developed scripts are not guaranteed to qualify for institutional integration support. You can learn more about the learning tool review process here.