Canvas API Proxy
Register an app, get it approved, and call the Canvas API through this host without ever holding a Canvas developer key.
How it works
- Sign in with your Canvas account and register an app: a name, your redirect URIs, and the access level you need.
- A staff member reviews it. Once approved, your
client_idandclient_secretbecome usable. - Run a normal OAuth2 authorization-code flow against
https://canvas.mhciael.com/oauth2/auth. - Call
https://canvas.mhciael.com/api/v1/...with the token you get back. The proxy forwards tohttps://canvas.jmu.eduusing its own developer key.
The real Canvas token is created and held here, and is never sent to your app. Revoking your app's approval cuts off its access immediately.
Access levels
Read access to the signed-in user's own profile, courses, enrolments and coursework. No writes of any kind.
Methods: GET HEAD
Full read and write access to courses the user can already reach: assignments, submissions, grades, pages, files and groups. Account-level endpoints and GraphQL stay closed.
Methods: GET HEAD POST PUT PATCH DELETE
Everything the developer key itself allows, including account-level endpoints, GraphQL and acting-as. Approve sparingly.
Endpoints
- Authorization
https://canvas.mhciael.com/oauth2/auth- Token
https://canvas.mhciael.com/oauth2/token- Revocation
https://canvas.mhciael.com/oauth2/revoke- API base
https://canvas.mhciael.com/api/v1/- Metadata
https://canvas.mhciael.com/oauth2/metadata