Make Canvas Work for You: Your First API Call with Scriptable

Published: 2026-02-08

If you have spent any time working in the Canvas LMS, you probably consider the user experience to be fairly straightforward and intuitive. Most teachers I work with say that ease of use is one of the best things about the platform. However, we can probably all agree that there are things we wish were easier to accomplish without having multiple screens or tabs open.

This post is the start of what is hopefully a game-changing journey in how you use the LMS. The catalyst? Canvas's own API. The goal is to make Canvas work for you instead of the other way around.

The Pitch: Canvas LMS + iPad + Scriptable

No difficult setups or complex installs. With a little bit of JavaScript, you can begin working with Canvas directly at the source. Together, we will begin automating tasks, creating content, and simplifying those tedious experiences.

But first, let’s make our first API call. The script in this post follows what I call "The Tap Method." It gives us a simple framework to work with:

Load: Setting the stage. This is where we add our login credentials and "address" for Canvas.
Tap: Making the connection. Here you build a request to "Tap In" to the Canvas API.
Process: Reading the mail. You will receive a JSON response; this is where we tell our script what to do with that info.

How do I access the API?

Before we can write a script, you need an Access Token. Think of this as a special key that lets your script act on your behalf.

Security Warning

Do not share this token with anyone. It is exactly like your password—anyone with this token has the same access to your Canvas account that you do.

Steps to Getting Your Access Token

Login to Canvas on a web browser.
Access your Account Settings: Click Account in the Global Navigation, then click Settings.
Scroll to "Approved Integrations" near the bottom.
Click + New Access Token.
Fill in details: For "Purpose," I recommend "API Scripting." For safety, you may also consider adding an expiration date.
Generate and Copy: Once you close the window, you cannot see the token again. Securely store it immediately.

Writing your first script using "The Tap Method"

Open the Scriptable app on your iPad or iPhone, create a new script, and let’s get to work.

1. Load your credentials

First, we assign variables. This keeps our sensitive info in one place and makes the code easier to read.

const baseUrl = "https://yourdomain.instructure.com/api/v1";
const apiToken = "<your-token-here>";

2. Tap in by building a request

Now we build the "envelope" that carries our request to Canvas.

Backtick Alert - In the code below, we use backticks (` `) found under the escape key on a keyboard, NOT standard apostrophes. This allows us to use ${baseUrl} to inject our school's URL directly into the string.

// Build the specific "address" for your profile
const url = `${baseUrl}/users/self/profile`;

// Open a new request
const request = new Request(url);

// Set your method - "GET" means we are asking for information
request.method = "GET";

// Set your headers (Your digital handshake)
request.headers = {
    "Authorization": `Bearer ${apiToken}`,
    "Content-Type": "application/json" 
}

3. Process the response

Finally, we tell Scriptable to send the request and show us what it found.

// The 'await' keyword tells the script: "Wait until the internet finishes loading!"
const response = await request.loadJSON();

// Log the response to the console to see the results
console.log(response);

There it is, your first API request!

Why did you show me this? :)

Everything in Canvas is driven by IDs and data points. While a GET request might seem like a lot of work just to see your own profile (which you can see easily in the app), this is the foundation.

Once you can "Tap" into your profile, you can "Tap" into your gradebook, your assignment lists, and your student rosters. I promise, as we progress, we will connect the dots between these simple lookups and the automation scripts that will save you hours of energy.

Stay tuned

In our next mini-post, we’re going to tackle a crucial step: Security. I’ll show you how to move your API token and url out of your code and into the iOS Keychain.