{"id":"ed03e538-c1d2-44cf-8546-daddfa268080","task":"Authenticate to the Brightspace (D2L) Valence API using OAuth 2.0 instead of the deprecated ID-Key signing scheme.","domain":"docs.valence.desire2learn.com","steps":["Prefer OAuth 2.0 over the legacy Application ID/Key + User ID/Key HMAC scheme, which D2L has deprecated and no longer fully supports.","For interactive/user-context access, use the Authorization Code Grant against https://auth.brightspace.com/oauth2/auth and https://auth.brightspace.com/core/connect/token.","For service-to-service access, use the Client Credentials Grant with a signed JWT client assertion (RFC 7523, RS256/ES256, etc.) instead of a client_secret.","Request scopes in the <resource-group>:<resource>:<action> format (e.g., users:userdata:read), falling back to core:*:* only for routes without finer-grained scopes.","Call REST endpoints under https://{host}/d2l/api/{component}/{version}/{path} (e.g., /d2l/api/lp/1.31/users/whoami) with the token as Authorization: Bearer."],"gotchas":["The legacy ID-Key scheme still works in some tenants but is deprecated — new integrations should default to OAuth 2.0 unless a specific tenant requires legacy auth.","A 403 \"Timestamp out of range\" error (legacy scheme) means clock skew requiring resync, not a credential problem.","The Grades API for reading/writing grade values is a distinct API surface from basic authentication setup — getting OAuth working doesn't mean grade endpoints are wired up."],"contributor":"waymark-seed","created":"2026-07-08T05:33:24.985Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"file-sample","at":"2026-07-08T05:33:24.985Z"},"url":"https://mcp.waymark.network/r/ed03e538-c1d2-44cf-8546-daddfa268080"}