Set up a Canvas connector

C1 provides identity governance for Canvas LMS. Integrate your Canvas instance with C1 for unified visibility and governance over user access to accounts, courses, and enrollments.

C1 provides identity governance for Canvas LMS by Instructure. Integrate your Canvas instance with C1 for unified visibility and governance over who has access to which accounts, courses, and enrollments.

Capabilities

Resource	Sync	Provision
Users
Accounts
Courses
Enrollments

The connector reads the users in your Canvas instance, the account hierarchy those users belong to, the courses defined under those accounts, and the enrollments that tie a user to a course. Each course exposes its enrollment roles — for example Teacher, TA, Student, and Observer — as entitlements, and C1 records a grant for every user enrolled in that course under a given role. This lets you see which users hold instructor or administrative access through their course and account memberships.

This connector reads from Canvas. It does not provision access, so the Provision column above is empty.

Gather Canvas credentials

You need an access token that belongs to a Canvas user with admin scope on the account you want to sync. An admin-level token is required for the connector to read accounts, the courses under them, and every user’s enrollments. A token scoped to a single user only sees that user’s own data.

1. Sign in to your Canvas instance as an administrator.

2. Open Account > Settings from the global navigation. Under Approved Integrations, click + New Access Token.

3. Give the token a purpose — for example C1 connector — and optionally set an expiry date. Leave the expiry blank for a token that does not expire.

4. Click Generate Token, then copy the token value immediately. Canvas shows the full token only once and you cannot retrieve it later.

5. Note your Canvas base URL — the domain you use to sign in, for example https://canvas.instructure.com or your institution’s self-hosted Canvas domain. This is the address the connector calls the Canvas REST API against.

Configure the Canvas connector

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for Canvas and click Add.

3. Choose how to set up the new Canvas connector.

4. Set the owner for this connector.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Enter the Canvas credentials:

   • Base URL: Your Canvas instance URL, for example https://canvas.instructure.com.
   • API token: The admin-scoped access token you generated above.
8. Click Save.

9. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Canvas connector is now pulling access data into C1.

Self-hosted

Follow these instructions to run the Canvas connector in your own environment.

1. Create a secret for the Canvas access token.

2. Configure the connector environment variables:

   • BATON_BASE_URL: Your Canvas instance URL, for example https://canvas.instructure.com.
   • BATON_API_TOKEN: The admin-scoped access token you generated above.
3. Deploy the connector using your standard self-hosted connector process.

Done. Your Canvas connector is now pulling access data into C1.

Connector configuration reference

Setting	Environment variable	Required	Description
Base URL	BATON_BASE_URL	Yes	The base URL of your Canvas instance, for example https://canvas.instructure.com. The connector calls the Canvas REST API under this host.
API token	BATON_API_TOKEN	Yes	An admin-scoped Canvas access token. Stored as a secret. Sent as the bearer token on every Canvas API request.

ConductorOne connectors

Browse the full catalog of ConductorOne connectors and integrations.

ConductorOne documentation

Learn more about identity governance and access management with C1.