API Token deprecation mid-2027
API access via tokens is being deprecated by Instructure (the parent company of Canvas) in the first half of 2027. Tokens will no longer be available. It is not clear at this time whether an acceptable replacement will be available once tokens are removed.
What is a Canvas API token?
An API token is a generated string of letters and numbers but it is not a standard password. API tokens are less secure than passwords because they circumvent MFA and SSO. It is a credential that allows anyone with the token to have programmatic access to Canvas that will appear to have been executed as the token owner. The token could allow another person, vendor, company, piece of software or application, including AI agents, to read, write, and modify any data, enrollments, courses, and grades to which the token owner has access.
Why do we limit use of API tokens?
The Academic Technology team maintains a policy against providing individual Canvas Application Programming Interface (API) user tokens. In rare cases, under certain circumstances and with approval, faculty or staff may be given access. Students will not be approved for tokens. We can only issue tokens to instructors with a teaching appointment or staff using the token in support of their department or role.
Limiting the issuance of user tokens is a critical security and stability requirement for maintaining our LMS environment. These risks include:
-
Data security: Granting API access increases the risk of a potential data breach. If an unmanaged or improperly secured application gains access, sensitive student and institutional data could be compromised. In addition, user tokens circumvent multi-factor authentication and university SSO authentication requirements.
-
Increasing risk from AI and third party services: Many AI tools and browser extensions now request Canvas API tokens to analyze coursework, generate summaries or feedback, automate downloads, grading insights, or submissions. These tools are often hosted externally, store tokens insecurely, have unclear data retention policies, and are not contractually vetted by the institution. In effect, users are being asked to delegate full account access to unvetted third parties, creating unacceptable risk to student records and institutional systems. The downstream impact of a compromised token can exceed that of a stolen password, especially since MFA provides no protection.
-
Approved AI tools: ChatGPT Education/Enterprise, Google Gemini, Notebook LM, and Copilot, while using your University SSO to sign in, are the only licensed, approved AI tools for DCL 3 (FERPA data). MU also has the use of Show-Me AI.
-
User accountability: Any actions taken using the token are the responsibility of the token holder.
-
System instability: Improperly coded or potentially abusive tools such as AI agents can use the token to run extensive numbers of API calls and overload the Canvas system, leading to performance issues, lag, or even system-wide outages for all users. We must safeguard the system's stability.
-
Compliance: Restricting access helps us comply with privacy regulations (such as FERPA) by ensuring only authorized, vetted systems can process educational records. It also helps us comply with Instructure's API policy. Instructure is the parent company of Canvas.
The future of Canvas API access
⚠️Note: API access via tokens is being deprecated by Instructure (the parent company of Canvas) in the first half of 2027. Tokens will no longer be available. It is not clear at this time whether or not there will be an acceptable replacement once tokens are removed.
During the time until tokens are deprecated, they are not necessarily prohibited, but must be:
- Approved via a vetting process
- Provisioned centrally with a managed lifecycle
- Used for approved integrations only
- Secured appropriately
- In support of a legitimate and justified business or academic need
It is a violation of Infosec and Acceptable Use to share a token with any other person, company, vendor or unapproved software.
Most institutional needs can still be supported using:
- Approved, third party LTI tools
- Contractually reviewed third‑party services
If you have questions, you may submit an email to Academic Technology for support.
Canvas campus and vendor resources