LTI 1.3 starter kit for .NET 10: login, launch, deep linking, roster and grades

What the kit covers

• OIDC login: the third-party initiated login that every LTI 1.3 launch starts with.
• Launch: the signed launch is validated and a session is started.
• Deep linking: returns the signed deep linking response so a course can place your content.
• Names and Roles: an instructor's roster through the Names and Role Provisioning Service.
• Grades: score passback through the Assignment and Grade Services.

On .NET 10. Built on ASP.NET Core and the .NET base class library only; no third-party runtime packages. The build turns NuGet audit warnings into errors, so a vulnerable dependency fails the build.

Endpoints

What is checked on every launch

The signature (RS256 only, key taken from the platform's JWKS by key id), issuer, audience, expiry and issued-at with one minute of skew, the nonce bound to a single-use server-side state, the LTI version, the deployment id, and the message type. A test covers each rejection path.

Registration guides

A guide for each of Moodle, Canvas, Blackboard Learn and D2L Brightspace: where to register the tool, which URLs to enter, which services to switch on, and which values to copy back into the kit's settings.

What's tested

The kit's 26 tests run against a simulated platform: a fake learning platform inside the test project. No live run against Canvas, Moodle, Blackboard or Brightspace has been recorded. The registration guides are set-up notes, not test results, and nothing on this page is a claim that the kit has been tested on those platforms.

Why now: in the platforms' own words

Blackboard

Source: Blackboard Developer Docs, "Registering a new LTI application". Read 25 October 2026.

• "Make sure your tool provider uses LTI 1.3 since Blackboard as of January 1st 2027 will no longer support LTI 1.1."

Brightspace

Source: D2L newsroom, "D2L Announces Security Enhancements with Retirement of LTI 1.1 Support", dated Toronto Sep 24, 2026. Read 25 October 2026.

• "To enable a smooth transition for customers, D2L will retire LTI 1.1 support in phases."
• "By February 2027, customers will no longer be able to add new LTI 1.1 integrations through the Brightspace user interface."
• "Beginning in March 2027, customers may opt in to disabling LTI 1.1 launches in their environments."
• "LTI 1.1 launches will then be disabled for all customers by October 2027."
• "Today, all new integrations with D2L Brightspace are required to use LTI 1.3."

No dated statement on LTI 1.1 from Instructure (Canvas) or Moodle was found when these pages were read, so none is quoted.

Licence and price

• Kit, USD 149: a single developer licence. One developer may use and modify the kit in their own tools and products.
• Team licence, USD 399: the developers of one organisation may use and modify the kit, with a 30-minute set-up review.

Both licences let you build and deploy your own tools from the kit. Neither lets you redistribute, resell or publish the kit's source, original or modified, as a source-code product, template, starter kit or repository. The kit is provided as is, without warranty; its tests run against a simulated platform. The licensor is eXtreme Coding Ltd trading as Helmworks.