LTI 1.3 Launch Handshake Simulator

Launch Traffic

Concurrent launches / wave 6

Network latency 700 ms

Tamper probability 0%

Stale JWKS key cache (tool never refreshed the platform's rotated public key)

Live Stats

In flight

Success rate

—

✓ Verified

✗ Rejected

Avg round-trip latency

—

Waiting for first launch…

How it works

An LTI 1.3 launch is an OpenID-Connect handshake: the LMS Platform signs a JWT id_token describing the user, course and role, and the external Tool must cryptographically verify that signature before it trusts the launch. Real LTI 1.3 uses asymmetric RS256 signing — the Platform signs with a private key, the Tool checks it against a public key fetched from the Platform's JWKS endpoint. This simulator uses a simplified modular stand-in for that check so the pass/fail logic stays visible:

signature_sent    = (payload · platformKey)  mod M
signature_checked = (payload · toolCachedKey) mod M
launch accepted  ⇔  signature_sent = signature_checked  AND  not tampered

Launch Wave Now — fires a batch of simultaneous launches (e.g. several students opening the same activity at once), each a JWT packet flying Platform → Tool.
Tamper probability — the chance a packet's signature gets corrupted in transit (a malformed integration or an attacker); tampered packets always fail the check above, however the keys line up.
Stale JWKS key cache — the real-world failure mode this models most closely: the Platform rotates its signing key, but the Tool kept an old cached public key, so toolCachedKey ≠ platformKey and every launch fails until Refresh JWKS Cache re-syncs it — exactly what a production LTI integration must do periodically against the Platform's jwks_uri.
Green packets passed verification and reached the Tool; red packets were rejected and never rendered the activity.

This is the handshake underneath SCORM's successor stack: SCORM 1.2/2004 tracked a single self-contained ZIP package via a JavaScript RTE API, while LTI (and its telemetry cousin xAPI) instead lets an external tool launch inside the LMS through exactly this signed, stateless request — no login of its own required.

LMS PLATFORMEXTERNAL TOOL

Verified launch (JWT valid) Rejected launch (signature fail)

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.