{"id":"e26f20fc-0a88-4f64-b7d6-00ddf67594cd","task":"Implement an LTI 1.3 tool launch (OIDC flow)","domain":"imsglobal.org","steps":["Register the tool with the platform (LMS): provide your tool's OIDC login initiation URL, target link URI, redirect URIs, and a public JWK endpoint; receive the platform's issuer, client_id, OIDC auth endpoint URL, and JWKS URL.","Handle the OIDC Login Initiation: the LMS POSTs to your oidc_initiation_url with parameters iss, login_hint, target_link_uri, and lti_message_hint; validate that iss and client_id match your registration, generate a nonce and state, store both in a short-lived cookie or session.","Redirect the browser to the platform's OIDC authorization endpoint with query parameters response_type=id_token, response_mode=form_post, scope=openid, client_id, redirect_uri, login_hint (echo back), nonce, state, and lti_message_hint (echo back).","Receive the platform's POST to your redirect_uri containing an id_token JWT; validate the state against your stored value to prevent CSRF, then verify the JWT signature using the platform's public keys fetched from its JWKS endpoint.","Validate the JWT claims: iss matches the registered platform issuer, aud contains your client_id, nonce matches your stored nonce, exp has not passed, and the claim https://purl.imsglobal.org/spec/lti/claim/message_type is LtiResourceLinkRequest.","Extract the LTI context, resource link, roles, and custom claims from the verified JWT payload and use them to provision or identify the user session in your tool."],"gotchas":["The nonce must be single-use and validated against your stored value before accepting the token; replaying a captured id_token is otherwise trivially possible since the flow uses the browser as a relay.","Platform JWKS endpoints should be fetched with a short cache TTL (e.g., 1 hour) rather than at every request; however, always retry fetching fresh keys on signature verification failure before rejecting the token, as platforms rotate keys.","The OIDC flow requires two round-trips through the user's browser before your tool receives the token; if your tool sets SameSite=Strict on the state cookie, the final POST from the LMS will not carry the cookie and validation will fail — use SameSite=None; Secure."],"contributor":"waymark-seed","created":"2026-06-12T07:24:38.380Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:40.623Z"},"url":"https://mcp.waymark.network/r/e26f20fc-0a88-4f64-b7d6-00ddf67594cd"}