Setting up an LTI 1.3 integration with your LMS

This guide walks an organization administrator through connecting a Learning Management System (LMS) to Cesura using LTI 1.3 (LTI Advantage). Once connected, instructors can drop Cesura activities straight into their courses, learners launch them without creating a separate Cesura account, and scores flow back to the LMS gradebook automatically.

LTI 1.3 is an open standard, so these steps work with any conformant LMS (Canvas, Moodle, Blackboard Learn, D2L Brightspace, and others). The wording of buttons and fields differs between LMSs — this guide uses the standard LTI terms and tells you what each one is called.

What you'll need

The LTI feature enabled for your organization. If you don't see an LTI tab in your organization settings (see Step 1), the feature isn't switched on yet — contact Cesura support (Contact support under Get help in the sidebar) to enable it.
Organization Admin access in Cesura. Only Organization Admins (and Cesura system admins) can manage LTI registrations.
Administrator access in your LMS — enough to register an external/LTI tool (for example, a Canvas Developer Key, a Moodle external tool, or a Blackboard LTI 1.3 tool).
A Cesura account for every instructor who will add activities, using the same email address their LMS sends, plus access to the Cesura space that holds those activities. The picker (Step 4) shows each instructor only the spaces they can reach in Cesura, so a missing or mismatched account shows an empty picker. Your LMS must also be set to release the instructor's email to the tool. Cesura does not store learner emails unless you turn anonymity off (see Privacy and access options below).

💡 Two ways to connect. Most LMSs support Dynamic Registration — a one-click, self-configuring flow. We recommend it. If your LMS doesn't support it, use Manual Registration instead. Both are covered below.

Step 1 — Open the LTI settings in Cesura

Sign in to Cesura as an Organization Admin.
Open Organization management from the main navigation menu.
In the left sidebar, select the LTI tab.

You'll see three sections:

Dynamic Registration, marked Recommended — the one-click setup, at the top of the page.
Tool URLs — the addresses you give your LMS so it can talk to Cesura.
Platform Registrations — the list of connected LMSs, and where you add one manually.

⚠️ Don't see the LTI tab? The feature isn't enabled for your organization yet. Contact Cesura support (Contact support under Get help in the sidebar) to turn it on, then return here.

Step 2 — Register Cesura in your LMS

Choose one of the two options below.

Option A — Dynamic Registration (recommended)

This is the fastest path: Cesura and your LMS exchange all the technical details automatically.

On the Cesura LTI page, in the Dynamic Registration card, click Generate registration URL.
Copy the Dynamic Registration URL that appears.
In your LMS, find the option to add an LTI tool by registration URL (sometimes called "LTI Advantage – Dynamic Registration", "Register an external tool by URL", or similar). Paste the URL there and start the registration.
In Moodle: go to Site administration → Plugins → Activity modules → External tool → Manage tools, paste the URL into the Tool URL box at the top and click Add LTI Advantage. When the tool card appears as Pending, click Activate.
Your LMS opens a short popup that completes automatically and shows "Registration complete — you can close this window."
Back in your LMS, approve / enable the newly created tool if it isn't enabled by default.

⚠️ The registration URL is single-use and expires in 1 hour. If it expires or you need to connect another LMS, just click Generate registration URL again to create a fresh one.

That's all for this path. Cesura creates the connection for you — it appears as Active in the Platform Registrations table (Step 3). With Dynamic Registration you do not need to copy the Tool URLs or use Add Registration — those are only for manual setup. Skip ahead to Step 3.

Dynamic Registration also requests the LTI Advantage services Cesura uses — Deep Linking, Assignment and Grade Services (AGS), and Names and Role Provisioning Services (NRPS). Some LMSs still ask an admin to approve these scopes when enabling the tool (step 6 above), so grade passback and roster sync work.

Option B — Manual Registration

Use this if your LMS doesn't support Dynamic Registration. It's a two-part exchange: you give your LMS Cesura's Tool URLs (B1), and your LMS gives you back the platform details that you enter in Cesura (B2).

⚠️ Do B1 before B2. Your LMS only generates the Client ID, Issuer, the three platform URLs, and the Deployment ID after you've created the tool with Cesura's Tool URLs. Once you save the tool, the LMS shows these values on the tool's configuration/details screen — copy them from there into B2.

B1. Give your LMS Cesura's Tool URLs

On the Cesura LTI page, copy the values from the Tool URLs card (use the copy button next to each). Your LMS needs these three:

Cesura calls it	Your LMS may call it	In Moodle	Example value
OIDC Login URL	OpenID Connect Initiation URL / Login URL	Initiate login URL	`https://app.cesura.ai/api/v1/lti/login`
Launch URL	Target Link URI / Launch URL	Tool URL and Redirection URI(s)	`https://app.cesura.ai/api/v1/lti/launch`
JWKS URL	Public keyset / JWKS / Public JWK URL	Public keyset (set Public key type to Keyset URL)	`https://app.cesura.ai/api/v1/lti/jwks`

💡 Always copy the URLs shown on your own LTI page rather than typing the examples above — they're generated for your account and will use your exact Cesura domain.

When registering the tool in your LMS:

Use the OIDC Login URL for your LMS's "OpenID Connect Initiation URL" (or "Login URL") field.
Use the Launch URL for the "Target Link URI" field, and as the Redirect URI if your LMS asks for one. The same Launch URL also handles deep linking — if your LMS has a separate "Deep Linking" or "content-selection" URL field, use the Launch URL there too.
Provide the public JWKS URL for the keyset — don't paste a raw public key. Letting your LMS fetch the keyset by URL keeps the connection working after key rotation.
Enable the LTI Advantage services Deep Linking, Assignment and Grade Services, and Names and Role Provisioning Services so grade passback and roster sync work.

B2. Enter your LMS's platform details in Cesura

After you save the tool in your LMS, it will display a set of platform values (and issue a Client ID). On the Cesura LTI page, click Add Registration and fill in the dialog:

Field in Cesura	What it is	Where to find it in your LMS
Name (optional)	A friendly label so you can recognize this connection later (e.g. "Canvas – Production").	You choose it.
Issuer (Platform URL)	The LMS's unique identifier (its issuer / platform ID). Must match exactly.	Shown in the LMS's LTI tool configuration / platform details.
Client ID	The ID the LMS assigned to the Cesura tool.	Issued by the LMS when you created the tool / developer key.
Platform OIDC Auth URL	The LMS's authorization (OIDC login) endpoint.	LMS LTI configuration / OpenID configuration.
Platform Access Token URL	The LMS's OAuth2 token endpoint (used for grade and roster services).	LMS LTI configuration / OpenID configuration.
Platform JWKS URL	The LMS's public keyset URL (Cesura uses it to verify the LMS's signed launches).	LMS LTI configuration / OpenID configuration.
Deployment IDs	A deployment ID identifies a specific place the tool is installed — an account, sub-account, or course. Type each one and press Enter or comma to add it.	Issued by the LMS after you create/deploy the tool; shown on the tool's configuration screen. Add it if your LMS provides one.

The Issuer, Client ID, and the three URLs are required. The same dialog holds the privacy and access options described in the next section. Click Create to save.

Moodle: what each field is called

Moodle uses its own names for the standard LTI fields, and two of them are easy to swap. Use these tables when your LMS is Moodle.

What Moodle asks you for — Site administration → Plugins → Activity modules → External tool → Manage tools → "configure a tool manually":

Field in Moodle	What to put in it
Tool name	Any label you like, for example "Cesura".
Tool URL	Cesura's Launch URL.
LTI version	LTI 1.3.
Public key type	Keyset URL — not RSA key.
Public keyset	Cesura's JWKS URL.
Initiate login URL	Cesura's OIDC Login URL.
Redirection URI(s)	Cesura's Launch URL (the same value as Tool URL).
Supports Deep Linking (Content-Item Message)	Tick it, so instructors get Select content. Leave Content Selection URL empty — Moodle then uses the Tool URL, which handles deep linking.
IMS LTI Assignment and Grade Services (Services)	Use this service for grade sync and column management, so scores reach the gradebook.
IMS LTI Names and Role Provisioning (Services)	Use this service to retrieve members' information as per privacy settings, so rosters sync.
Share launcher's name with tool (Privacy)	Always.
Share launcher's email with tool (Privacy)	Always — without the email, the instructor's activity picker is empty.

Save the tool. On its card in Manage tools, open View configuration details — the Tool configuration details box holds everything Cesura needs.

What Moodle gives back, and where each value goes in the Cesura Add Registration dialog:

Value in Moodle	Field in Cesura	Typical Moodle value
Platform ID	Issuer (Platform URL)	`https://moodle.example.edu`
Client ID	Client ID	A random string such as `bvWcN0uVErkFtVf`
Deployment ID	Deployment IDs	A short number such as `3`
Authentication request URL	Platform OIDC Auth URL	`https://moodle.example.edu/mod/lti/auth.php`
Access token URL	Platform Access Token URL	`https://moodle.example.edu/mod/lti/token.php`
Public keyset URL	Platform JWKS URL	`https://moodle.example.edu/mod/lti/certs.php`

⚠️ Don't swap auth.php and certs.php. Moodle calls its keyset the Public keyset URL while Cesura calls the same thing the Platform JWKS URL, so the pair is easy to cross. If you do cross them, Check connection reports that the key set is not valid JSON, and learner launches leave Moodle and never come back. Swap the two values and run Check connection again.

Step 3 — Confirm the connection

Your LMS now appears in the Platform Registrations table with a green Active status. That's the connection in place — you're ready to add activities to courses.

Each row of the table shows:

Name: the registration's name, with its issuer and client ID beneath it, and a Dynamic or Manual label that says how it was created. The client ID tells apart two registrations for the same LMS.
Status: Active or Disabled. After you run Check connection, it also shows Reachable or Unreachable.
Settings: Anonymous for a registration that does not store learner emails, or Stores emails for one that does. Trusted instructors, or Trusted instructors (n) when you approved specific emails, appears when trusted embedding is on. Instructor sign-in appears when instructors can open Cesura signed in.
Created: the date the registration was created.

Click a registration's name to open its details panel. The panel shows the connection details, each with a copy button, and the learner and access switches described in the next section. It also has Edit and Check connection buttons.

Privacy and access options

Each registration has options that control what Cesura stores about learners and which spaces instructors see. A registration made with Dynamic Registration gets the defaults. A manual registration shows them in the Add LTI Registration dialog, under Learner and access settings.

To change them later, use either way:

The details panel. Click the registration's name and flip a switch. Each switch saves on its own. Turning off Anonymise learners (don't store their email), turning on Let instructors open Cesura signed in, or turning on Let organization admins see every space asks you to confirm first. Trust instructors from this LMS and its approved emails are shown in the panel but change only in Edit.
Edit. Click Edit on the registration's row. The Edit LTI Registration dialog groups its fields into Connection and Learner and access settings. For a registration made with Dynamic Registration, the connection fields start hidden; click Show to see them. Your LMS filled them in, so change them only if your LMS administrator asks you to.

Option	Default	What it does
Anonymise learners (don't store their email)	On	Cesura never saves learner email addresses from the LMS, only display names. Space member lists show no email for these learners. Turn it off only if you need Cesura to store the LMS email of each learner.
Trust instructors from this LMS	Off	Off: only instructors who have a Cesura account in your organization can add activities, and each sees only their own spaces. On: any teacher who launches from this LMS can add activities without a Cesura account. See Let external instructors embed your simulations below.
Let organization admins see every space	On	On: when the LMS sends the email of an organization admin who authors content, the picker lists every working space in your organization, which matches what that admin can reach in Cesura. Off: everyone, admins included, sees only their own spaces. This option appears only when Trust instructors from this LMS is off.
Let instructors open Cesura signed in	Off	On: an instructor who launches from this LMS gets an Open in Cesura button that opens their own Cesura account. See Let instructors open Cesura signed in below.

Registrations created before anonymity became the default were all switched to anonymous, including any that were set to store emails, and the learner emails they had stored were cleared. To store LMS emails again, edit the registration and turn off Anonymise learners (don't store their email).

When to turn off Let organization admins see every space. An LMS can send any email address in a launch. If someone who controls your LMS sends an organization admin's email, that launch reaches every working space in your organization. Turn the option off to limit every launch to the spaces of the person it names.

Before you add activities: put them in an LMS space

Instructors can only deep-link activities that already live in a Cesura Space. Testing spaces never appear in the picker. Use the LMS — SCORM / LTI 1.3 access level: learners can then open the activities only from your LMS, and a direct Cesura link to them is refused. Create the space from the Library before adding activities in your LMS:

Open the Library and find your simulation.
Click the Share with a group icon on the simulation’s card.
Keep Create New selected, give the space a Name, and set the Access Level to LMS — SCORM / LTI 1.3.
Click Create Space. Add any other simulations from the space’s Content tab — they’ll all be available to deep-link.

Already have a space? Open Share with a group from the Library and choose Add to Existing.

Step 4 — Add a Cesura activity to a course (instructor)

Connecting the LMS doesn't place any content by itself. An instructor adds Cesura activities to a course using Deep Linking:

In the LMS course, add external/LTI content and choose the Cesura tool (the action is often labelled "Add content", "Select content", or appears as a content-item picker).
Cesura opens the Add a Cesura activity picker, grouped by space. Search or filter by space, then select one activity or several.
The activities are placed into the course as links learners can open.

For the picker's filters, multi-select, badges, and limits, see Add Cesura activities from your LMS.

Which spaces the picker shows. An instructor sees the spaces they own, and the spaces where they are a member with more than view-only access. A membership that has expired or been turned off does not count. An organization admin who authors content sees every working space in the organization, unless you turned off Let organization admins see every space. For activities to appear, the instructor must have a Cesura account whose email matches the email their LMS sends. If the picker is empty, that's almost always the cause.

What an instructor without a Cesura account sees. The picker still opens — nothing errors out — but it lists no activities and shows a short explanation instead:

“We couldn't match your LMS account to a Cesura user in this organization, so there are no activities to show. Ask your Cesura administrator for access, and make sure your LMS shares your email address with Cesura.”

The same message appears when the instructor does have a Cesura account but it belongs to a different organization than the one this LMS is registered to. Either give them an account in the right organization, or turn on trusted embedding (next section) so they don't need one.

Deep linking is also limited to instructor and staff roles. If the LMS opens the picker for someone the course lists as a learner, Cesura refuses the launch with “Only instructors can add Cesura activities.” — check that person's role in the LMS course.

Let external instructors embed your simulations

By default, a registration runs in member mode: an instructor needs a Cesura account in your organization (with a matching email) to pick your activities in the LMS, and sees only their own spaces. You can instead trust every teacher from an LMS, so external instructors who have no Cesura account can embed designated activities into their own LMS courses through deep linking. This grants embedding only — no rosters, runs, or reports are shared.

To trust an LMS, edit its registration (Organization management → LTI) and turn on Trust instructors from this LMS. Optionally add Approved instructor emails to restrict who can embed; this requires the LMS to send the instructor's email. Leave the list empty to allow any teacher from that LMS. The Settings column then shows Trusted instructors, or Trusted instructors (n) when you added emails.

Trusted instructors see only the working spaces in your organization that are marked as shareable with outside instructors, not your whole catalog. Credit warnings do not appear for them in the picker. Contact Cesura support before you turn this on, so the right spaces are set up.

An instructor whose address is missing from Approved instructor emails gets the picker with a different message — “Your LMS email is not on the approved list for embedding Cesura activities. Ask your Cesura administrator to add you.” — and no activities.

Let instructors open Cesura signed in

An instructor who launches Cesura from the LMS can open Cesura in a new tab, signed in to their own existing Cesura account, without typing a password. This is off by default. Turn on Let instructors open Cesura signed in for the registration, in its details panel or in Edit.

When it is on, the What would you like to open? screen an instructor sees on launch also offers Open in Cesura, next to Open simulation and View report.

The first time, Cesura asks the instructor to sign in the normal way, then shows Link your LMS account. They click Link account to confirm. Cesura emails the account owner about the new link.
After that, Open in Cesura signs them straight in. If their account uses two-factor authentication, Cesura still asks for the code.

Rules that always apply:

The email the LMS sends must match the Cesura account email every time. If the LMS sends no email, or a different one, sign-in is refused and the instructor is told why.
Cesura never creates an account through this sign-in. The instructor needs an existing account in your organization.
The instructor's Cesura role comes from their Cesura account, not from the LMS.

An instructor can remove a link at any time from Profile → Security, under Linked LMS accounts, with Remove link. As an organization admin, open the registration's more-actions menu in the Platform Registrations table and choose Linked accounts to see and remove the accounts linked on that LMS. Removing a link stops that sign-in until the instructor links again. Deleting the registration removes its links too.

Step 5 — How learners launch

A learner simply clicks the activity link in their LMS course. Cesura validates the launch and takes them straight into the simulation — no separate Cesura login or account creation is required. Their identity is provided securely by the LMS.

Cesura recognises a learner the LMS has already identified, so it does not ask them again for details it was given. If the space collects something the launch cannot supply — a gender for the AI character, or acceptance of your terms — the learner still sees that screen once, with their name taken from the LMS. Launching a second assignment in the same course does not repeat it.

A Cesura link in the course menu

Some LMSs can also place Cesura in the course's own menu, for example a Cesura item in the Canvas course navigation. That link names no activity, so Cesura opens a Cesura activities page instead. It lists the activities this course has already used through its assignments, and the learner picks one with Open.

The page lists only activities that a learner in this course has already opened from an assignment, not every activity in the space.
If there are none, a learner is told to open the activity from its assignment, and an instructor is told to add activities through the LMS external-tool picker.
If the course's Cesura activities are closed, the page says so.
An activity opened from the course menu sends no grade back to the LMS. Grades flow only from assignments added through the picker in Step 4.

The page appears in the learner's language. Other launch problems, such as a closed course window, also show a page in the learner's language instead of a raw error.

Grades flow back automatically (AGS)

When a learner completes an activity, Cesura pushes their score back to the LMS gradebook automatically using Assignment and Grade Services. There's nothing to click — it happens on completion.

For grades to appear, the LMS must have granted grade services to the tool. Dynamic Registration handles this for you; for manual setups, make sure Assignment and Grade Services is enabled in the LMS tool configuration.

Rosters sync automatically (NRPS)

When an instructor opens the activity in a course, Cesura syncs that course's roster in the background using Names and Role Provisioning Services, so the right participants are associated with the activity. This runs automatically — there's no manual sync step.

Roster sync only works if the LMS granted NRPS to the tool (again, automatic with Dynamic Registration; enable Names and Role Provisioning Services in manual setups).

Managing your registrations

In the Platform Registrations table on the LTI page, each row has an Edit button (the pencil icon) and a More actions menu. You can:

Edit a registration — update its name, URLs, deployment IDs, or settings.
Linked accounts (in the menu) — see and remove the Cesura accounts instructors linked on this LMS. See Let instructors open Cesura signed in.
Check connection (in the menu, or in the details panel) — asks your LMS for its key set and reports Reachable or Unreachable, with a sentence saying what went wrong. Use it right after registering.
Disable a registration (in the menu) — the LMS can no longer launch Cesura until you re-enable it. Use this to pause a connection without deleting it.
Enable a disabled registration (in the menu) — restores launches.
Delete a registration (in the menu) — removes it permanently. Before it does, it counts what is attached, so the confirmation names it: “This permanently removes the registration, N embedded activity link(s), N grade binding(s), N learner(s) who joined through this LMS, and N linked sign-in account(s). Learner runs are kept.”

Check the connection after you register

Registering a platform does not open a connection to it. Until someone launches, a registration that Cesura cannot actually reach looks identical to a healthy one — and the first person to find out is a learner, who gets an opaque error. Check connection fetches the platform key set over the exact path every launch travels, so it catches a certificate or firewall problem before your students do. Run it once after Step 3.

Delete versus disable

Disable pauses a connection and keeps it. Delete removes it, and works whatever is attached — a test install or one pointed at the wrong LMS is exactly the case that needs removing. Learner runs are kept either way: they belong to the Cesura space, not to the LMS that launched them.

A deleted registration's issuer and client ID stay reserved for your organization. You can register the same pair again at any time, but another organization that tries to register it is refused. If the LMS has moved to another Cesura organization, contact Cesura support to release the pair.

Troubleshooting

Symptom	Likely cause & fix
No LTI tab in organization settings	The LTI feature isn't enabled for your organization. Contact Cesura support (Contact support under Get help in the sidebar) to enable it.
"This registration link is invalid or has expired"	The Dynamic Registration URL is single-use and expires after 1 hour. Click Generate registration URL to create a new one and register again.
Launch fails or shows a validation error	Run Check connection on the registration first — it tells you in one step whether Cesura can reach the platform at all. If it reports Reachable, then for manual registrations check that the Issuer and Client ID match your LMS exactly, the Platform JWKS URL is reachable, and the registration is Active. If your LMS uses deployment IDs, make sure the correct one is added.
Dynamic Registration fails	The message now names the cause rather than reporting an unexpected error. A TLS failure says which host and why — most often that the platform is not sending its intermediate CA certificates, which is a fix on the LMS side. A timeout, a refused connection and a DNS failure each say so. A platform whose discovery document is missing required keys lists them by name.
Registering says the issuer and client ID are reserved to another organization	Another Cesura organization deleted a registration with the same issuer and client ID, and the pair stays reserved to it. If this LMS is yours, contact Cesura support to release the pair.
Cesura shows a blank default icon in Moodle	The tool icon is now sent during Dynamic Registration, but existing registrations do not update themselves. Re-register the tool, or set the icon URL by hand in the Moodle tool settings.
Instructor's activity picker is empty, or says “We couldn't match your LMS account to a Cesura user in this organization”	The instructor's LMS email must match their Cesura account email, that account must belong to this organization, and they must have access to the Cesura space containing the activities. If your LMS hides user email by default, turn on email release for the tool. An expired or turned-off space membership, or a view-only role, does not count. To drop the account requirement altogether, use trusted embedding.
“Only instructors can add Cesura activities.”	Deep linking is limited to instructor and staff roles. The LMS is sending a learner role for this person — correct their role in the LMS course and retry.
Check connection says the key set is not valid JSON, or launches leave the LMS and never return	The platform's authentication and keyset URLs are swapped. In Moodle, Platform OIDC Auth URL must be the Authentication request URL (`.../mod/lti/auth.php`) and Platform JWKS URL must be the Public keyset URL (`.../mod/lti/certs.php`). Edit the registration, swap them, and run Check connection.
Scores aren't appearing in the gradebook	Confirm the learner finished the activity, and that Assignment and Grade Services is enabled for the tool in your LMS. A learner who opened the activity from the course-menu link sends no grade; they must open it from its assignment.
The course-menu Cesura link shows Open the activity from your course	No learner in this course has opened a Cesura activity from an assignment yet, so there is nothing to list. Add activities through the picker (Step 4) and have learners open them from their assignments.
Space member lists show no learner emails	The registration is anonymous, which is the default. Cesura keeps only display names. To store LMS emails, edit the registration and turn off Anonymise learners (don't store their email).
An organization admin sees only their own spaces in the picker	Let organization admins see every space is off for this registration, or the admin's account does not author content. Turn the option on if the admin should see the whole organization.
Roster isn't syncing	Confirm Names and Role Provisioning Services is enabled in your LMS. Roster sync runs when an instructor opens the activity, not on a learner launch.

Quick reference

Tool URLs Cesura gives your LMS (copy the exact values from your LTI page):

OIDC Login URL — https://app.cesura.ai/api/v1/lti/login
Launch URL (Target Link URI / Redirect URI; also handles deep linking) — https://app.cesura.ai/api/v1/lti/launch
JWKS URL (public keyset) — https://app.cesura.ai/api/v1/lti/jwks

Platform details your LMS gives Cesura: Issuer (Platform URL), Client ID, Platform OIDC Auth URL, Platform Access Token URL, Platform JWKS URL, and Deployment ID(s). In Moodle these are the Platform ID, Client ID, Authentication request URL (/mod/lti/auth.php), Access token URL (/mod/lti/token.php), Public keyset URL (/mod/lti/certs.php), and Deployment ID, all shown under View configuration details.

Need a hand? Reach out through Contact support under Get help in the sidebar and we'll help you get connected.