PHPackages                             groton-school/slim-canvas-api-proxy - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [API Development](/categories/api)
4. /
5. groton-school/slim-canvas-api-proxy

ActiveLibrary[API Development](/categories/api)

groton-school/slim-canvas-api-proxy
===================================

2.1.1(8mo ago)0192[4 issues](https://github.com/groton-school/slim-canvas-api-proxy/issues)[1 PRs](https://github.com/groton-school/slim-canvas-api-proxy/pulls)GPL-3.0PHPCI passing

Since Aug 17Pushed 5mo agoCompare

[ Source](https://github.com/groton-school/slim-canvas-api-proxy)[ Packagist](https://packagist.org/packages/groton-school/slim-canvas-api-proxy)[ RSS](/packages/groton-school-slim-canvas-api-proxy/feed)WikiDiscussions main Synced today

READMEChangelogDependencies (4)Versions (8)Used By (0)

groton-school/slim-canvas-api-proxy
===================================

[](#groton-schoolslim-canvas-api-proxy)

Server-side actions and routes for authenticating to and accessing the Canvas LMS API from a web client

[![Latest Version](https://camo.githubusercontent.com/e5c42dd1a4d5464ce8c14520d2499d5fd5736db62b8ebe3ed00e40e8823e602a/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f67726f746f6e2d7363686f6f6c2f736c696d2d63616e7661732d6170692d70726f78792e737667)](https://packagist.org/packages/groton-school/slim-canvas-api-proxy)

Install
-------

[](#install)

```
composer require groton-school/slim-canvas-api-proxy
```

Use
---

[](#use)

This is an implementation of [groton-school/slim-oauth2-api-proxy](https://github.com/groton-school/slim-oauth2-api-proxy#readme). This provides a server-side proxy to the Canvas LMS API for a web app (which would not normally be able to directly call an API hosted on another domain due to CORS restrictions). The canonical example of how to use this is [groton-school/slim-skeleton's gae/lti-tool\_canvas-api-proxy branch](https://github.com/groton-school/slim-skeleton/tree/gae/lti-tool_canvas-api-proxy#readme).

One significant caution, however, is that the LTI is *not* portable across all three Canvas instances (Production, Beta, Test) without thoughtful configuration. The logic of this is clear: Test or Beta have no way of knowing that Production issued a valid API token to this user. Moreover, Test and Beta may well have older, less complete, or differently updated data than Production, causing 404 errors (at best).

One approach to this is to leverage the `HTTP_ORIGIN` header, although doing this while also dancing the third-party cookie dance to get sessions set up is a little tricky. An example of this can be found in the [Planner LTI](https://github.com/groton-school/planner-lti/blob/889f0cd0cdd083fb5f029617c8e2cf5d21f085ea/app/dependencies.php#L68-L87). In this case, *when the `HTTP_ORIGIN` header is available* but also *while we are in the LTI launch-initiated PHP session* we store the provided `HTTP_ORIGIN` in the session for future use when it will *not* be provided (e.g. by a JavaScript call to the API Proxy.)

Of particular note is [the closing line of the definition](https://github.com/groton-school/planner-lti/blob/889f0cd0cdd083fb5f029617c8e2cf5d21f085ea/app/dependencies.php#L85) which *closes* the session that was manually opened, potentially so that [groton-school/slim-lti-partititoned-session](https://github.com/groton-school/slim-lti-partitioned-session#readme) can reopen it as part of the middleware stack.

###  Health Score

33

—

LowBetter than 72% of packages

Maintenance66

Regular maintenance activity

Popularity10

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity41

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~10 days

Total

6

Last Release

269d ago

Major Versions

1.0.2 → 2.0.02025-09-09

### Community

Maintainers

![](https://www.gravatar.com/avatar/d0554a28104c65004c6de4d335ada25cf2763c8a9691dc5611314486d461fa4c?d=identicon)[battis](/maintainers/battis)

---

Top Contributors

[![battis](https://avatars.githubusercontent.com/u/419619?v=4)](https://github.com/battis "battis (17 commits)")

---

Tags

canvaslmscors-proxyrestful-apislim-frameworkslim4

###  Code Quality

Code StylePHP CS Fixer

### Embed Badge

![Health badge](/badges/groton-school-slim-canvas-api-proxy/health.svg)

```
[![Health](https://phpackages.com/badges/groton-school-slim-canvas-api-proxy/health.svg)](https://phpackages.com/packages/groton-school-slim-canvas-api-proxy)
```

###  Alternatives

[exsyst/swagger

A php library to manipulate Swagger specifications

35916.4M7](/packages/exsyst-swagger)[hubspot/api-client

Hubspot API client

24016.2M20](/packages/hubspot-api-client)[pocketmine/bedrock-protocol

An implementation of the Minecraft: Bedrock Edition protocol in PHP

172445.0k15](/packages/pocketmine-bedrock-protocol)[botman/driver-telegram

Telegram driver for BotMan

93459.5k6](/packages/botman-driver-telegram)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)