Skip to content
Atomic ReactorAtomic Reactor

LTI 1.3 Advantage

Atomic Reactor provides a production-ready implementation of the 1EdTech (IMS Global) LTI 1.3 Advantage standard. It works both as a Tool (launching inside an LMS such as Canvas or Brightspace) and as a Platform (hosting other LTI tools).

Core capabilities

Section titled “Core capabilities”
  • OIDC launch flow — secure, token-based third-party-initiated login.
  • JWKS key rotation — automatic key rotation for signing and verification.
  • Deep Linking — rich content selection from inside the platform.
  • Dynamic Registration — simplified, self-service tool deployment.

LTI Advantage services

Section titled “LTI Advantage services”
  • Assignment & Grade Services (AGS) — pass grades back to the platform, sync line items and results, and support multiple score types. See the partner deep-dive on LTI AGS.
  • Names and Role Provisioning Services (NRPS) — securely retrieve course rosters, sync roles, and paginate large memberships with Link headers.

Modes of operation

Section titled “Modes of operation”

Tool mode (consumer)

Section titled “Tool mode (consumer)”

Use Atomic Reactor content inside another LMS:

  • Configure Atomic Reactor as an external tool in the LMS.
  • Launch content modules, pass grades back to the LMS gradebook, and sync the roster in.

Platform mode (provider)

Section titled “Platform mode (provider)”

Embed external tools inside Atomic Reactor:

  • Register external tools (e.g. Kahoot, Zoom) in the Atomic Reactor admin.
  • Launch them within course modules and receive grades back into the Atomic Reactor gradebook.

OIDC launch flow

Section titled “OIDC launch flow”

LTI 1.3 uses the OpenID Connect third-party-initiated login flow:

  1. The user clicks an LTI link in the platform.
  2. The platform sends an initiate-login request (iss, login_hint, target_link_uri).
  3. Atomic Reactor responds with an auth request (state, nonce, client_id).
  4. The platform builds and signs an id_token containing the LTI claims.
  5. The platform posts the id_token back to Atomic Reactor.
  6. Atomic Reactor verifies the signature (via JWKS), checks the nonce, and validates claims.
  7. A session is created and the user is redirected to the content.

The state parameter (CSRF protection) and nonce (replay protection) are both stored server-side and are single-use.

Setting up a tool deployment

Section titled “Setting up a tool deployment”
  1. Navigate to Admin → LTI Integrations.
  2. Click Add Tool.
  3. Enter the platform configuration (issuer, auth URL, JWKS URL).
  4. Copy the Atomic Reactor configuration (public key, initiate-login URL, redirect URI) into the platform.

Configuration

Section titled “Configuration”

Set LTI_PLATFORM_GUID explicitly in production. It identifies this Atomic Reactor instance in every launch token, and per the LTI 1.3 spec it must be stable across restarts and shared by all tenants on the instance. If unset, a UUID is deterministically derived from PUBLIC_URL. Generate one with uuidgen.

Privacy levels (Public, Name Only, Email Only, Anonymous) control how much PII is shared during a launch. All LTI communication requires TLS 1.2+, and OAuth2 tokens are encrypted at rest.

Reference

Section titled “Reference”