PHPackages                             groton-school/slim-canvas-api-proxy - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [API Development](/categories/api)
4. /
5. groton-school/slim-canvas-api-proxy

ActiveLibrary[API Development](/categories/api)

groton-school/slim-canvas-api-proxy
===================================

2.1.1(7mo ago)0192[2 issues](https://github.com/groton-school/slim-canvas-api-proxy/issues)[1 PRs](https://github.com/groton-school/slim-canvas-api-proxy/pulls)GPL-3.0PHPCI passing

Since Aug 17Pushed 3mo agoCompare

[ Source](https://github.com/groton-school/slim-canvas-api-proxy)[ Packagist](https://packagist.org/packages/groton-school/slim-canvas-api-proxy)[ RSS](/packages/groton-school-slim-canvas-api-proxy/feed)WikiDiscussions main Synced 1mo ago

READMEChangelogDependencies (4)Versions (8)Used By (0)

groton-school/slim-canvas-api-proxy
===================================

[](#groton-schoolslim-canvas-api-proxy)

Server-side actions and routes for authenticating to and accessing the Canvas LMS API from a web client

[![Latest Version](https://camo.githubusercontent.com/e5c42dd1a4d5464ce8c14520d2499d5fd5736db62b8ebe3ed00e40e8823e602a/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f67726f746f6e2d7363686f6f6c2f736c696d2d63616e7661732d6170692d70726f78792e737667)](https://packagist.org/packages/groton-school/slim-canvas-api-proxy)

Install
-------

[](#install)

```
composer require groton-school/slim-canvas-api-proxy
```

Use
---

[](#use)

This is an implementation of [groton-school/slim-oauth2-api-proxy](https://github.com/groton-school/slim-oauth2-api-proxy#readme). This provides a server-side proxy to the Canvas LMS API for a web app (which would not normally be able to directly call an API hosted on another domain due to CORS restrictions). The canonical example of how to use this is [groton-school/slim-skeleton's gae/lti-tool\_canvas-api-proxy branch](https://github.com/groton-school/slim-skeleton/tree/gae/lti-tool_canvas-api-proxy#readme).

One significant caution, however, is that the LTI is *not* portable across all three Canvas instances (Production, Beta, Test) without thoughtful configuration. The logic of this is clear: Test or Beta have no way of knowing that Production issued a valid API token to this user. Moreover, Test and Beta may well have older, less complete, or differently updated data than Production, causing 404 errors (at best).

One approach to this is to leverage the `HTTP_ORIGIN` header, although doing this while also dancing the third-party cookie dance to get sessions set up is a little tricky. An example of this can be found in the [Planner LTI](https://github.com/groton-school/planner-lti/blob/889f0cd0cdd083fb5f029617c8e2cf5d21f085ea/app/dependencies.php#L68-L87). In this case, *when the `HTTP_ORIGIN` header is available* but also *while we are in the LTI launch-initiated PHP session* we store the provided `HTTP_ORIGIN` in the session for future use when it will *not* be provided (e.g. by a JavaScript call to the API Proxy.)

Of particular note is [the closing line of the definition](https://github.com/groton-school/planner-lti/blob/889f0cd0cdd083fb5f029617c8e2cf5d21f085ea/app/dependencies.php#L85) which *closes* the session that was manually opened, potentially so that [groton-school/slim-lti-partititoned-session](https://github.com/groton-school/slim-lti-partitioned-session#readme) can reopen it as part of the middleware stack.

###  Health Score

36

—

LowBetter than 81% of packages

Maintenance79

Regular maintenance activity

Popularity10

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity40

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~10 days

Total

6

Last Release

214d ago

Major Versions

1.0.2 → 2.0.02025-09-09

### Community

Maintainers

![](https://www.gravatar.com/avatar/d0554a28104c65004c6de4d335ada25cf2763c8a9691dc5611314486d461fa4c?d=identicon)[battis](/maintainers/battis)

---

Top Contributors

[![battis](https://avatars.githubusercontent.com/u/419619?v=4)](https://github.com/battis "battis (17 commits)")

---

Tags

canvaslmscors-proxyrestful-apislim-frameworkslim4

###  Code Quality

Code StylePHP CS Fixer

### Embed Badge

![Health badge](/badges/groton-school-slim-canvas-api-proxy/health.svg)

```
[![Health](https://phpackages.com/badges/groton-school-slim-canvas-api-proxy/health.svg)](https://phpackages.com/packages/groton-school-slim-canvas-api-proxy)
```

###  Alternatives

[stripe/stripe-php

Stripe PHP Library

4.0k143.3M475](/packages/stripe-stripe-php)[twilio/sdk

A PHP wrapper for Twilio's API

1.6k92.9M270](/packages/twilio-sdk)[knplabs/github-api

GitHub API v3 client

2.2k15.8M187](/packages/knplabs-github-api)[facebook/php-business-sdk

PHP SDK for Facebook Business

90121.9M34](/packages/facebook-php-business-sdk)[meilisearch/meilisearch-php

PHP wrapper for the Meilisearch API

73813.7M114](/packages/meilisearch-meilisearch-php)[google/gax

Google API Core for PHP

263103.1M452](/packages/google-gax)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)