Integrating Gamified Learning with Moodle, Canvas and Blackboard: LTI 1.3, SCORM, xAPI and Open Badges

How an LTI 1.3 launch works

LTI 1.3 builds on OpenID Connect. The core specification and the 1EdTech Security Framework define a third-party-initiated login in which the LMS (the platform) and your tool exchange a signed JSON Web Token, the id_token.[1][2]

The claims that matter

Claims sit under https://purl.imsglobal.org/spec/lti/claim/. A resource link launch must carry message_type (LtiResourceLinkRequest), version (1.3.0), deployment_id, target_link_uri, resource_link and roles, which may be an empty array, plus sub except in anonymous launches.[1] Two details are often missed. The context claim is optional, so a tool must not assume a course; and the resource_link id must change when a link is copied, which matters for any per-link game state. Values in the custom claim must be strings, and a value starting with $ asks the platform to substitute data such as $Context.id.[1]

Only sub is a required user claim. Name, email and locale are optional, and a platform may launch anonymously, leaving out sub and every identity claim. The certification suite tests both cases, so a tool should handle them by design.[1][8]

Keys and rotation

Sign with RSA keys of at least SHA-256 (RS256), publish them in a JSON Web Key Set, give every key a kid even when there is only one, and never reuse a kid for a different key. To rotate, add the new key under a new kid and keep the old one in the set while both are in use.[2] Rotate keys inside a stable key-set URL: a 2021 Blackboard developer post notes that changing the URL itself forced institutions to redeploy the tool.[39]

The LTI Advantage services

Deep Linking 2.0: placing content and creating the grade column

In an LtiDeepLinkingRequest, the platform sends deep_linking_settings with a deep_link_return_url, accept_types and accept_presentation_document_targets, and optionally accept_multiple, accept_lineitem and auto_create. The tool answers by form-posting a signed LtiDeepLinkingResponse in a parameter named JWT, with content_items of type ltiResourceLink, link, file, html or image.[3] An ltiResourceLink can carry a lineItem with a label, scoreMaximum, resourceId and tag, so the gradebook column is created with the link. The specification calls this the declarative approach and prefers it where it fits.[3][4]

Assignment and Grade Services 2.0

The launch carries an endpoint claim with the granted scopes and the line item URLs. The four scopes are https://purl.imsglobal.org/spec/lti-ags/scope/lineitem, …/lineitem.readonly, …/result.readonly and …/score. Scores are posted to the line item URL with /scores appended, as application/vnd.ims.lis.v1.score+json.[4]

A score carries userId, timestamp, activityProgress (Initialized, Started, InProgress, Submitted, Completed) and gradingProgress (FullyGraded, Pending, PendingManual, Failed, NotReady), with scoreGiven and scoreMaximum when there is a score. Four rules decide whether gamified tools behave: platforms may ignore anything not FullyGraded; a missing scoreGiven clears any previous score; timestamps must strictly increase and never repeat for the same learner and line item; and a platform must not apply an update older than the one it holds.[4]

Names and Role Provisioning Services 2.0

With the contextmembership.readonly scope, a tool can read a course roster. Each member carries at least a user_id, matching the launch sub, and roles; anything more depends on the platform's consent, so tools should not rely on it. Results are paged through Link headers.[5] For gamification, the roster is useful for team challenges; most tools can avoid it and create users at launch.

Dynamic Registration

LTI Dynamic Registration 1.0 automates the exchange of configuration between tool and platform, though an administrator still reviews and activates the result. It remains a candidate final specification, yet all three platforms support it in some form. Its claims array is also a privacy control: a tool can ask for sub alone.[6][7]

What each LMS does with LTI 1.3

Moodle

Administrators register a tool dynamically by pasting its registration URL and choosing "Add LTI Advantage", available since Moodle 3.10, or manually with a key set URL, login URL and redirect URIs.[25][28] Moodle's iss is the site address, its key set is at /mod/lti/certs.php and its token endpoint at /mod/lti/token.php. Sharing the launcher's name and email with the tool defaults to never.[27]

Moodle's grade handling is stricter than the specification. Its 5.2 code rejects a score without userId, timestamp, gradingProgress or activityProgress, sets scoreGiven to null unless the score is FullyGraded, rescales scores to the grade item's maximum, and returns HTTP 409 when the stored grade is as new as or newer than the incoming timestamp, compared to the whole second. Two updates within the same second therefore clash.[27] Moodle can also publish its own courses and activities to other platforms as an LTI Advantage tool, synchronising grades and members every 30 minutes by default.[25]

Canvas

LTI 1.3 tools are configured as developer keys, entered manually or from JSON, and installed in an account or course by client ID; disabling or deleting the key removes every installation. Canvas supports dynamic registration, where the default privacy level is anonymous and administrators can remove requested scopes.[31][36] The privacy_level setting takes anonymous, name_only, email_only or public, but sub is always sent. Hosted Canvas uses https://canvas.instructure.com as its issuer, with authentication and key-set endpoints on sso.canvaslms.com.[31]

A Deep Linking content item with a lineItem creates an assignment, from three placements: assignment selection, the course assignments menu and the module index menu. A line item created without a resource link creates a placeholder assignment.[32][33] Canvas returns HTTP 400 for a score timestamp earlier than the stored result and 422 for a user who is not a student in the course, and ignores scoreGiven when progress is NotReady, Failed or Pending. Roster requests return 50 members per page by default.[33] Canvas notifies tools of course imports through its Platform Notification Service, without retrying failed deliveries, and supports LTI platform storage for browsers that block third-party cookies.[31][32] Its REST API is throttled by a cost per request, returning HTTP 429, and since June 2026 rejects requests without a User-Agent header with HTTP 403.[34]

Blackboard

The tool vendor registers once in the Blackboard Developer Portal and receives an application (client) ID, the issuer https://blackboard.com and the platform endpoints; institutions then deploy the tool by client ID, and Blackboard generates a deployment ID. Dynamic registration happens in the Developer Portal. Blackboard accepts RS256 and RS512 signatures.[38] Administrators choose which user fields to send (role, name and email address are preselected) and whether each tool may read rosters and grades, and grade services only expose columns the tool created. LTI must be enabled in three places, and deleting a tool's domain or placement breaks existing links permanently.[41] Some Blackboard developer pages differ from the specification on details such as the scores path, so build to the specification and test.[38] Its Developer Portal limits REST calls to 10,000 per 24 hours per developer group by default, returning HTTP 429 with a Retry-After header; whether this also covers LTI service calls is not documented.[39]

Designing grade passback for gamified tools

Points, streaks and levels belong in the tool. The gradebook should receive something an assessor would recognise. In practice:

• Post mastery, not raw points. Unbounded points fit badly in a gradebook, and Moodle and Canvas rescale to the column maximum. Keep points in the tool and post a bounded score, such as a mastery percentage with scoreMaximum of 100.[4][27][33]
• Send scores only when final. Post scoreGiven with gradingProgress of FullyGraded, and never send a progress-only update after a score exists, because a missing scoreGiven clears it.[4]
• Create columns declaratively. Return a lineItem through Deep Linking, and before creating any line item programmatically, look up existing ones by resource_link_id, resource_id or tag.[3][4]
• Use time carefully. Send ISO 8601 timestamps with sub-second precision from clock-synchronised servers, and no more than one score per learner and line item per second.[4][27]
• Recover without duplicates. The grade service has no idempotency key. After an ambiguous failure, read the current result, then re-post with a later timestamp.[4]
• Survive course copies. Resource link IDs change on copy while resourceId and tag survive; Canvas also offers $Context.id.history and copy notices.[1][4][32]

SCORM: portable, with sharp edges

SCORM remains the most portable way to put content inside an LMS, and the usual choice where tools cannot be hosted externally. The limits that matter for game-like content are these:[18][19]

Moodle supports SCORM 1.2, passing the ADL conformance test suite, but not SCORM 2004: some 2004 packages may appear to work, but development has stopped. Its "SCORM standards mode" is off by default, which lets SCORM 1.2 packages store up to 64,000 characters of state, so a package that relies on this may fail elsewhere.[26][27] Canvas needs its SCORM tool enabled at account level. It plays SCORM 1.2 and SCORM 2004 2nd to 4th Editions as a graded assignment, ungraded assignment or page, a choice that cannot be changed after import; uploads default to 100 points, and SCORM is not available in Canvas beta or test environments.[36] Blackboard plays SCORM 1.2, SCORM 2004 4th Edition, AICC and xAPI packages through its SCORM Engine, grading the whole package or individual SCOs. With multiple attempts it uses the last graded attempt, and the grade schema and maximum cannot be changed after import.[42]

For gamified content, that means shipping SCORM 1.2 where Moodle is involved, keeping saved state within 4,096 characters (compress it, or keep state on a server), and testing in SCORM Cloud, which plays and debugs packages but does not certify them.[43]

xAPI and cmi5

An xAPI statement needs an actor, a verb and an object, and may carry a result with a score scaled from −1 to 1, success, completion and duration. Where personal data is a concern, the specification recommends identifying the actor by an opaque account name.[20] IEEE 9274.1.1-2023, which IEEE describes as standardising xAPI 1.0.3, was adopted in 2025 as ISO/IEC/IEEE 39274-1-1, and ADL's specification repository lists xAPI 2.0 as the current version.[20][21]

cmi5 adds the missing LMS launch. The LMS launches an assignable unit with endpoint, fetch, actor, registration and activityId; the unit exchanges the one-time fetch URL for an authorisation token, reads launch data including the moveOn rule, and must send "initialized" first and "terminated" last.[22]

None of the three platforms is a learning record store. Moodle's core xAPI library, added for H5P, is not meant to be a full LRS, but the logstore_xapi plugin forwards Moodle events to an external LRS and ADL publishes a cmi5 launch plugin.[23][29] We found no native xAPI, LRS or cmi5 support documented for Canvas. Blackboard plays xAPI packages without an LRS, and its SCORM Engine can forward SCORM activity data to an external LRS.[42]

Open Badges 3.0 and portable credentials

Open Badges 3.0 aligns badges with the W3C Verifiable Credentials Data Model 2.0, a W3C Recommendation since May 2025. Credentials are OpenBadgeCredential or AchievementCredential, signed as VC-JWT or with a Data Integrity proof, with issuer keys found at an HTTP URL or a DID, and can be bundled into a Comprehensive Learner Record 2.0.[14][15][17] Moodle core issues certified Open Badges 2.0, with 3.0 in development. In Canvas, Parchment Digital Badges issues 3.0 for paid organisations that opt in, and those badges are private by default. In Blackboard, the Achievements tool links to Milestone, which moved to 3.0 in July 2025 and holds an active 3.0 issuer certification.[9][12][13][49][50] For gamified tools, the practical choice is to issue credentials for meaningful achievements through one of these issuers, or as a certified issuer yourself, rather than pushing badge counts into the gradebook.

Analytics events

Caliper 1.2, published in 2020, defines event envelopes and metric profiles, but Canvas and Blackboard use 1.1 in practice.[16] Canvas Live Events can be delivered in Caliper 1.1 format to a queue or a signed webhook, with monthly key rotation and up to three retries; Canvas Data 2 provides bulk snapshots and incremental queries.[35] Blackboard holds an active Caliper 1.1 certification and can stream events to an external store.[11][39] Moodle has no native Caliper; its options are web services and log store plugins.[28][29]

Privacy, security and UK law

Role first. Under the ICO's edtech guidance, whether a provider is a controller or a processor depends on who actually controls the processing, whatever the contract says. A provider that only follows an institution's instructions is likely a processor, but one that uses pupils' data for its own purposes, such as product development, becomes a controller and may bring the Children's code into scope.[44] In June 2026 the ICO reported on its audits of 28 edtech providers, whose products included learning management systems. Misjudging this role was the most common problem, especially where data fed product development or analytics, alongside thin contracts, incomplete data-flow maps and weak impact assessments.[45]

Minimise at launch. Request only sub and roles, using the registration claims array and anonymous launches where possible. In Moodle, leave name and email sharing at never; in Canvas, set privacy_level to anonymous; in Blackboard, untick name and email and turn off roster access a tool does not need. Use opaque identifiers in xAPI.[6][27][31][41][46]

Mind transfers and the 2026 changes. Restricted international transfers need adequacy regulations, approved safeguards or an exception.[46] Since 19 June 2026, organisations must run a data protection complaints process under the Data (Use and Access) Act, and on 30 September 2026 the ICO formally became the Information Commission.[47]

Be ready to rotate. In May 2026 the US Department of Education warned of a cybersecurity incident involving Canvas, carried out through Free-for-Teacher accounts, and advised institutions to rotate LTI tools, single sign-on connectors and API keys.[48] Every integration should have a documented key rotation procedure.

Testing and certification

1EdTech certification means passing its test suite, which deliberately sends malformed launches, and renewing every year as a member; platforms must pass the core and all three services. Development tools include the LTI reference implementation and build.1edtech.org.[8] SCORM Cloud plays and debugs SCORM, xAPI, cmi5 and LTI content and includes an LRS, and ADL's CATAPULT provides cmi5 test suites for content and for LMSs, with a reference player.[23][43] For platforms: Moodle's public sandbox resets hourly and moodle-docker runs locally; Canvas is open source and runs locally under Docker, though a self-hosted instance uses its own issuer; and Blackboard publishes a developer image, the current one expiring on 13 November 2026.[30][37][39]

A reference architecture

Putting these constraints together, a gamified tool that integrates with all three platforms needs four parts of its own: an LTI service, a game engine, a grade policy and a privacy layer. The diagram reads from top to bottom.

Failure modes to design for

• Clock skew breaks token validation and grade ordering: synchronise clocks and allow only a few minutes of leeway.[2][4]
• Key rotation breaks launches if old keys disappear early or the key-set URL changes.[2][39]
• Duplicate line items appear when tools post before looking up existing columns; Canvas turns each into a placeholder assignment.[4][33]
• Course copies change resource link IDs, orphaning per-link state unless the tool maps history.[1][32]
• Rate limits return HTTP 429 in Canvas and Blackboard: back off and spread synchronisation.[34][39]
• Blocked third-party cookies break the login state: use LTI platform storage where the LMS supports it, with a fallback.[31][38]
• Destructive admin actions, such as deleting a Canvas developer key or a Blackboard tool domain, remove installs or break links: put them in runbooks.[36][41]

Implementation checklist

Where EdTechLab stands

We hold ourselves to the standard this report describes. Our platforms intle, EngagedLab and interacty export SCORM 1.2 and SCORM 2004 (4th Edition) packages. In July 2026, intle's packages passed all 124 SCORM Cloud checks, run across both versions combined. Because Moodle does not support SCORM 2004, Moodle sites should use the SCORM 1.2 export.

LTI 1.3, the LTI Advantage services and live xAPI are not features of our products today. When a client project needs them, we scope and build the integration against the checklist above. Sky, our research and development programme for module-level learning design, is being designed to install into Blackboard Ultra and Canvas through LTI 1.3, with Moodle and Brightspace planned to follow. 1EdTech LTI 1.3 conformance certification is planned before general availability.

Limits of this report

• Specification and platform details reflect documents and directory entries on 4 October 2026; certification status and platform behaviour change.
• Moodle behaviour is taken from its 5.2 source code; Canvas and Blackboard behaviour from their documentation, which sometimes differs from the specifications.
• We did not run live integrations against production instances for this report.
• Some points could not be verified, including the engine behind Canvas's SCORM tool, native xAPI or cmi5 in Canvas, and Moodle support for LTI platform storage.