5 ms·
It's the latter. It sounds like they got suspended because they told their users (i.e students) to give them their canvas API tokens so that they could fetch co
by doix 2y ago
It's the latter. It sounds like they got suspended because they told their users (i.e students) to give them their canvas API tokens so that they could fetch course materials on their behalf.
Previously, students had to download the PDFs and manually upload them. If students gave eightball their API tokens, eightball could fetch their course materials on their behalf.
Perhaps I'm missing something, but that's how it reads to me.
- semi-extrinsic 2y agoFrom TFA: <<university’s IT department was angry that the company allowed students to connect their own Canvas API tokens to the app>> Just a wild guess, but maybe the IT department gets charged an additional fee from Canvas based on the usage of API tokens? Conflicts like these are always about money, one way or another.
- loeg 2y agoConflicts in bureaucracies like universities are often petty power struggles rather than anything financial. Especially between IT departments and anyone else.
- dylan604 2y ago> give them their canvas API tokens in pretty much every single system's terms, providing someone else your tokens or other forms of sharing of credentials is expressly forbidden. this is why I am flabbergasted things like Plaid work. I will never provide a 3rd party my credentials to anything but damn sure not something like a bank or credit card.
- javagram 2y agoThere are many systems that allow generating a API token to be used with other apps. The article clearly indicates that this school learning system, “Canvas”, had such a functionality until it was removed during this saga, apparently by hiding it with CSS or something since there was an “inspect element” workaround to still access it. Plaid uses OAuth for many of their connections and doesn’t violate ToS in that case. There usually are TOS related to not sharing your password and disclaiming liability if you do.
- loeg 2y ago3rd party access is the entire point of API tokens. Use cases like this are why Canvas has them.