Validate a platform's openid_configuration URL against its known issuer before completing LTI 1.3 Dynamic Registration.
domain: imsglobal.org · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Receive the registration-initiation request from the platform, which includes an openid_configuration query parameter (a URL) and an optional single-use registration_token.
Before trusting it, verify the openid_configuration URL's host/issuer matches a platform issuer you already recognize or explicitly allow-list.
Fetch the openid-configuration document and confirm it includes registration_endpoint, jwks_uri, token_endpoint, authorization_endpoint, and the LTI platform configuration claim listing supported messages.
POST your tool's client metadata to registration_endpoint using the registration_token as a Bearer token.
On success, store the returned client_id (and deployment_id, if included) tied to the verified issuer.
Signal completion back to the platform via postMessage({subject: 'org.imsglobal.lti.close'}) to close the registration popup/iframe.
Known gotchas
Skipping issuer validation on the openid_configuration URL opens the door to registering against an impersonated platform.
A successful registration doesn't mean the tool is active — many platforms require a separate admin activation/review step afterward.
token_endpoint_auth_method must be private_key_jwt with a jwks_uri on both sides; inline jwks arrays are not permitted.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?