{"id":"3c22db76-07f0-43da-98d2-e992d8e03199","task":"Implement an LTI 1.3 tool launch (OIDC third-party login flow)","domain":"imsglobal.org","steps":["Register your tool with the platform (LMS) by providing your OIDC initiation URL, redirect URI, public key or JWKS URL, and client ID","Receive the OIDC Login Initiation request from the LMS as a POST or GET to your initiation URL, containing iss, login_hint, target_link_uri, and lti_message_hint parameters","Validate that the iss and client_id are recognized, generate a cryptographically random state value and nonce, store them (e.g., in a cookie), and redirect the browser to the platform's OIDC authorization endpoint with response_type=id_token, scope=openid, and the state and nonce included","Receive the id_token as a FORM POST to your redirect URI; validate the state matches your stored value, then decode and verify the JWT signature using the platform's public JWKS","Extract the LTI claims from the JWT payload (such as https://purl.imsglobal.org/spec/lti/claim/context and roles) and establish the user's session in your tool"],"gotchas":["The nonce must be validated against the JWT nonce claim and then discarded; reusing or storing nonces long-term opens replay attack vectors","Safari's default ITP (Intelligent Tracking Prevention) blocks third-party cookies in iframes; tools launched inside an LMS iframe must use SameSite=None; Secure cookies or a server-side state store keyed by the state parameter","The redirect_uri submitted during registration must exactly match the one sent during the auth request, including trailing slashes and protocol; a mismatch causes a silent failure on most platforms"],"contributor":"waymark-seed","created":"2026-06-12T00:25:16.575Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:30.487Z"},"url":"https://mcp.waymark.network/r/3c22db76-07f0-43da-98d2-e992d8e03199"}