PDF Tools · Canvas LMS · Setup guide · Early access

Installing EqualWeb PDF Accessibility on Canvas

Install EqualWeb into your Canvas and it appears in your course and account menus. It lists the PDF files in your courses, checks them for accessibility, and - with your EqualWeb credits - remediates them. A Canvas administrator does it in about five minutes, and there is nothing to download.

Before you start

What you need

A Canvas account administrator login on the root account, with the LTI Registrations - Manage permission. A sub-account administrator cannot complete the wizard.
Your Canvas must be reachable from the internet over HTTPS. Instructure-hosted Canvas always is; a self-hosted Canvas behind a VPN or an IP allowlist cannot be used.

Two values you need from us: the registration URL and the callback URL. Both are the same strings for every institution, and neither is published here - your EqualWeb contact sends them to you when your institution is enabled for early access. Keep them to hand: you will paste the first in step 2 and the second in step 7. If you do not have them yet, contact us or book a short call.

It is a value you paste, not a link you click. Copy it into the Dynamic Registration field inside Canvas. If you open it in a browser you will get a polite EqualWeb card telling you exactly that - which is correct behaviour, not an error.

Install

Six steps inside Canvas

Open the app installer

Go to Admin → your account → Apps → Manage → Install a New App
Choose LTI 1.3, then Dynamic Registration.

In newer Canvas versions the same screen is Admin → Apps → Manage Apps → + App → Dynamic Registration.

Paste the registration URL

Paste the value we sent you https://…/register into the registration URL field and continue.

Permissions - nothing to approve

EqualWeb requests no Canvas API permissions at this step. An empty permissions screen is exactly what you should see.

Data sharing - choose "All user data"

EqualWeb has to know who is opening the tool, so that only instructors and administrators can run checks against your files. Name and email are never stored - the identity is used only to decide what that person may do.

If Canvas sends no user identity the launch is refused, with "Canvas did not identify the launching user." That is deliberate and fail-closed: an anonymous session would be indistinguishable from the account owner's, and this app can spend credits and write files.

Placements - leave the defaults

EqualWeb installs into the course navigation and account navigation menus, visible to administrators and instructors only. Students never see the menu item, and a student who reaches the URL anyway gets an honest card instead of a session.

Review, then Install App

Click Install App. You will see "EqualWeb is registered ✓" and the window closes by itself.
Open any course, or your account menu, and click EqualWeb PDF Accessibility. The app opens inside Canvas - you are already signed in, and there is no separate EqualWeb password.

One step left

Let EqualWeb read your course files

An LTI install identifies people but grants no access to files at all - that is deliberate in the LTI standard. So the first screen says "One step left: let EqualWeb read your course files." A Canvas account administrator connects it with a second developer key and one Authorize click. Your course PDFs appear the moment the connection is verified.

The EqualWeb connection screen offers two ways to do it. Both end in the same place; pick one.

Option 1 · Recommended

API developer key (OAuth2)

No secret to keep in sync, and access is renewed automatically. This is the path we ship and support.

In Canvas

Go to Admin → Developer Keys → + Developer Key → + API Key - a separate, second key next to the LTI one from step 2.
Key Name: EqualWeb API
Redirect URIs - the top field, not "Redirect URI (Legacy)": paste the EqualWeb callback URL https://…/oauth/callback we sent you with the registration URL.
Leave Enforce Scopes off. If your policy requires it on, tick every endpoint on the EqualWeb scope list plus Allow Include Parameters.
Save, switch the key ON in the list, then copy its Client ID and secret (Show Key).

In EqualWeb

Under Option 1 - API developer key, paste the Client ID and secret.
Account ID: usually 1.
Save platform credentials, then Authorize with Canvas.
The Canvas approval screen opens in a new tab - approve it and close the tab. EqualWeb verifies the connection by itself.

Paste the API key's Client ID, not the LTI key's. The two look alike in the Developer Keys list; EqualWeb refuses the LTI one at Save and explains why.

Never remove a scope from a live key. Canvas revokes every token on that key the moment one is removed.

Option 2 · Alternative

Admin access token

The original method, still fully supported. Quickest to set up, and handy for a test - but the token is a long-lived secret you manage yourself.

In Canvas

Go to Account → Settings → + New Access Token
Purpose: EqualWeb. Leave the expiry date empty - a token that expires takes the connection down with it.
Generate Token and copy it. Canvas shows it only once.

In EqualWeb

Under Option 2 - access token, paste the token.
Account ID: usually 1.
Save platform credentials, then Test connection. It reports the identity the tool will act as - if that is not who you expect, correct it here.

The token carries the permissions of whoever created it, and nothing renews it: if it expires or its owner changes role, the connection stops until you paste a new one.

Whichever option you choose, use a dedicated administrator (service) account - not a personal one. The connection belongs to the Canvas user behind it: if that user is deactivated or deleted, Canvas cuts the access off immediately. A service account survives staff changes.

No college ever enters Canvas credentials. There is one connection, it belongs to the institution, and a sub-account administrator sees the form read-only.

What it costs

Free checks from day one

Every institution gets 10 free accessibility checks per day, with no EqualWeb account required - reset daily, counted per institution. AI remediation, and any volume beyond the daily allowance, use your EqualWeb credits.

An LMS-verified institution administrator can paste the EqualWeb API key from inside Canvas - Settings → API key - with no involvement from us. Institutions with several colleges can also switch to split billing under Settings → Billing, where each college holds its own key and its own invoice.

See credit pricing →

Roles

What each person sees

What an institution administrator, a college administrator and an instructor each see
	Institution administrator	College administrator	Instructor
Documents	Every course in the institution	Their own college only	Their own course only
Courses, Analytics, Permissions, Settings	Yes	Yes, scoped to their college	No
The Canvas connection (step 7-8)	Sets it up	Read-only - the connection belongs to the whole institution	Sees "Waiting for your Canvas administrator"
EqualWeb API key	Single billing: theirs · split billing: none	Single billing: none · split billing: theirs	Never

The launch is accepted only for Instructor, Teaching Assistant, Content Developer or Administrator. A college administrator's scope is not a setting we apply - Canvas is asked who they administer at every launch, and the answer decides what they see.

Adding a college later? Nothing to install. The college is a Canvas sub-account like any other; the moment it exists, its administrator can open the tool and see their own documents. Under split billing they add their own API key and are invoiced separately from then on.

Self-hosted Canvas

Requirements on your own instance

Instructure-hosted customers need nothing here. A self-hosted Canvas must be reachable from the public internet over HTTPS with a publicly trusted certificate - we fetch your signing keys on every launch and call your REST API from our servers - and it must not sit behind an IP allowlist, because our calls come from Cloudflare's edge and there is no fixed address to allow. A Canvas that is only reachable internally cannot be connected.

If something looks wrong

Troubleshooting

Every entry here is a real failure we hit on a live Canvas and fixed.

I opened the install link and got an EqualWeb page telling me to paste it into my LMS

That is correct behaviour, not an outage. The registration URL is a value you paste into a field inside Canvas, not a page to visit. Copy it into Admin → Apps → Manage → Install a New App → LTI 1.3 → Dynamic Registration.

The install wizard says the configuration points at a different host

The Canvas instance advertises its login and keys endpoints on a different domain than the one that served its configuration. This is a genuine mismatch - send us your Canvas URL and we will look at it. We only accept endpoints served by the same Canvas host.

The EqualWeb area inside Canvas is blank, or says "refused to connect"

Almost always a leftover EqualWeb session from another platform (SharePoint, Box, Google Drive) in the same browser. The launch clears it automatically now - click the EqualWeb menu item in Canvas again. If it persists, open Canvas in a private window.

"Another EqualWeb session was open"

Same cause as the blank screen, caught and explained. Click the EqualWeb item again.

"Your browser blocked the sign-in"

The browser refused to keep the session cookie inside the Canvas iframe - strict third-party-cookie settings, Safari ITP, or an extension. Allow cookies for the EqualWeb domain the app runs on, or open the menu item in a new tab.

"Canvas did not identify the launching user"

Data sharing is not set to All user data. Edit the app in Canvas, set data sharing / privacy level to All user data (Public), and relaunch. EqualWeb refuses an identity-less launch on purpose - see step 4.

"For instructors and administrators"

A student, or a user with no teaching role, opened the tool. Expected: access is decided by the Canvas role, not by whether the menu item is visible.

The documents list is empty although the connection tested fine

The Account ID points at an account that holds no courses, or the authorising user is enrolled in none. Clear the Account ID field - EqualWeb detects the right account - and save again. Saving new credentials clears the cached listing, so it re-scans immediately.

It listed nothing, we fixed the connection, and it still lists nothing

A completed listing is cached for an hour; an empty one for five minutes. Saving credentials drops the cache - reload the page.

"Waiting for your Canvas administrator"

An instructor opened the tool before an account administrator completed step 8. Only an institution administrator can connect the file library.

The list stops with "Scan not finished - reload the page to continue"

A very large account: the crawl is deliberately bounded per page load. Reload and it resumes where it stopped.

"redirect_uri does not match client settings" after clicking Authorize

Either the LTI key's Client ID was pasted into the API-key field (the two look alike in the Developer Keys list - the app now refuses the LTI one at Save), or the API key's Redirect URIs field is empty or was filled only in the "Redirect URI (Legacy)" box. Put the EqualWeb callback URL we sent you in the top Redirect URIs field.

Authorize opens and immediately fails, or Canvas shows a 404

The consent screen cannot render inside a frame, which is why we always open it in a new tab - and an unbound or OFF developer key returns 404 from the authorize endpoint. Switch the API key ON in the Developer Keys list.

"The provided value is incorrect", or a warning about Site Admin keys (self-hosted only)

The key is being created in the Site Admin context instead of the institution's root account. Create both keys from the root account's own Developer Keys page and install the app there. Instructure-hosted customers never see this.

Every call fails with "Insufficient scopes on access token"

Enforce Scopes is on with missing or zero ticks. Turn it off, or tick the complete EqualWeb scope list - and never remove a scope from a live key, because Canvas revokes every token on that key the moment one is removed.

"The Canvas authorization has expired or was revoked"

The developer key was switched off or deleted, or the Canvas user who approved the connection was deactivated. Fix the key, or restore the user, then click Authorize with Canvas again. Approving from a dedicated service account prevents this from recurring.

Everything worked, then stopped (access-token option)

The pasted Canvas access token expired, or its owner was deactivated. Create a new token with no expiry date and save it again - or move to Option 1, the developer key with Authorize.

"This Canvas does not match the connection"

The saved LTI details belong to a different Canvas instance. Contact us - we never silently rebind an institution's connection.

"Sign-in link already used" or "expired"

A launch link was reused, bookmarked or opened twice - each is valid once, for 60 seconds. Click the EqualWeb item in Canvas again, and do not bookmark the app URL; always enter from the Canvas menu.

Still stuck? Open a support request · About the product: PDF Accessibility for Canvas LMS

Early access

Get your install details

Tell us about your Canvas and we will enable your institution and send the two values you need - then this guide takes about five minutes.

Book a meeting Contact us