How to get a Canvas access token (for students)

A Canvas access token is a long password that lets an app read your Canvas account for you: your classes, your assignments, your due dates. You make it yourself in Canvas settings. It takes about two minutes, and you need a web browser. The Canvas phone app can't do it.

The steps

1. Log in to Canvas in a browser. Use your school's own Canvas address, the one in the address bar when you're logged in. It often looks like yourschool.instructure.com.
2. Open Account, then Settings. Account is at the top of the menu on the left.
3. Scroll down to Approved Integrations. It's below your profile details and ways to contact you.
4. Click + New Access Token.
5. Fill in Purpose. Type the name of the app you're making it for, so you can tell your tokens apart later.
6. Pick an expiration date. Choose the latest date your school allows. See below for why you may not get much choice.
7. Click Generate Token, then copy it right away. Canvas shows the full token once. After you close that window you can't see it again; you'd have to make a new one.
8. Paste it into the app that asked for it.

How long a token lasts

It depends on your school. Many schools now cap how long a student's token can live, and the cap is different from place to place. We've seen 30 days, 90 days and 120 days. Some still let you leave the date blank, which means it doesn't expire.

So plan on making a new one at least once a semester. When a token expires, whatever was using it stops updating, usually without telling you. If an app that reads Canvas suddenly looks out of date, an expired token is the first thing to check.

If there's no New Access Token button

Some schools turn it off for students. If the button is missing or greyed out, you can't fix that from your side. A few schools let you request a token through their IT help desk, so it's worth searching your school's help site for “Canvas access token.” Otherwise, the app you're setting up needs another way in. For a to-do list, uploading your syllabus is the usual fallback.

Treat it like a password

• A token can do what you can do. Canvas doesn't let students make a read-only one. Anyone holding it could see your coursework and messages, and act as you. Only give it to an app you trust, and never post it or send it to a person.
• One token per app. Then you can cut off one without breaking the rest.
• You can delete it anytime. Back in Account, then Settings, under Approved Integrations, each token has a delete button. Deleting it cuts the app off immediately.
• Clean up at the end of the semester. Delete tokens for things you've stopped using.

It says my token is invalid

• You copied part of it. Tokens are long, and it's easy to miss the end. Make a new one and use the copy button if there is one.
• Wrong Canvas address. A token only works on the school that made it. If the app asks for your Canvas address, use the exact one from your browser.
• It expired or was deleted. Check the list under Approved Integrations. If it's gone or past its date, make a new one.

Connecting School Mom? The token goes on the Add classes page after you sign up, along with your Canvas address.