Integrate BigBlueButton with Canvas LMS

01

Choose the supported integration path

Canvas exposes BigBlueButton through Conferences in supported editions. The built-in service and a self-hosted endpoint are not interchangeable configuration fields in every Canvas deployment; confirm the entitlement and integration route with Instructure before promising a server swap.

• Canvas account-admin access and Conferences entitlement confirmed.
• Decision recorded: Canvas-provided service, approved app, or custom LTI/API connector.
• Test course with teacher, student, section and group memberships.

02

Prepare BigBlueButton and credentials

Use a production BigBlueButton endpoint with a trusted TLS certificate. Keep the API shared secret or LTI secret on the server side: it is equivalent to an application credential and must never be placed in browser code, a public repository or a screenshot.

1. 1

   Confirm the BigBlueButton server is healthy and that its public hostname resolves correctly.

2. 2

   Retrieve the API URL and shared secret with sudo bbb-conf --secret, or create a dedicated LTI key and secret where the integration uses LTI.

3. 3

   Record the platform version, connector version, owner and rollback point before making the change.

sudo bbb-conf --check
sudo bbb-conf --secret

03

Configure Canvas LMS

Make the first connection in a staging course, workspace or tenant. Use a dedicated test teacher and test learner so role mapping can be observed rather than inferred from an administrator account.

1. 1

   Enable or place Conferences/BigBlueButton in course navigation according to the Canvas account policy.

2. 2

   If using an approved external connector, exchange credentials server-to-server and restrict it to the test account first.

3. 3

   Create a conference with recording and waiting-room options.

4. 4

   Choose invite-all, sections, groups or named users and document how that affects recording access.

04

Run an end-to-end acceptance test

A green “connection successful” message proves only that one API request worked. The useful test follows the complete classroom lifecycle from creation through recording publication.

1. 1

   Create and start a conference as the instructor.

2. 2

   Join as invited and non-invited students and verify the boundary.

3. 3

   Test section/group selection, calendar visibility and course-copy behaviour.

4. 4

   End and publish a recording, then verify exactly which course users can play it.

05

Common problems and practical fixes

Start with timestamps, browser developer tools and the logs on both sides. Repeatedly replacing secrets rarely fixes a hostname, TLS, role or callback problem and makes the evidence harder to follow.

• A missing Conferences link can be hidden course navigation or an account-level entitlement.
• Do not assume Canvas SaaS allows an arbitrary self-hosted BBB URL.
• Course copies can require fresh conference configuration; test rather than inheriting assumptions.

06

Production hardening and upgrades

Restrict who can create rooms, define recording retention, test accessibility and document the integration owner. Pin or approve connector updates, subscribe to upstream releases and repeat the acceptance test after changes to the LMS, connector, BigBlueButton or reverse proxy.

• Do not expose the BigBlueButton shared secret to course authors or client-side JavaScript.
• Use least-privilege teacher roles and test guest, suspended and unenrolled users.
• Monitor API errors, failed joins, recording processing and disk growth.
• Keep a short rollback runbook: previous package, configuration backup and maintenance window.