title: Desire2Learn authentication from LTI to Valence
body: <p>Given an LTI request, how does one authenticate to the Valence API?</p>
  
  <p>The only thing that I have seen is this:</p>
  
  <p><a href="https://stackoverflow.com/questions/10524572/widgets-and-apis-in-desire2learn">Widgets and APIs in Desire2Learn</a></p>
  
  <p>This seems to indicate that when our External Learning Tool receives a POST 
  from the D2L server, that we can then issue a Valence API authentication 
  request, which is a GET of the form:</p>
  
  <p>"https://{server domain}/d2l/auth/api/token?x_a={app id}&amp;x_b={unencoded redirect url signed with app key}&amp;x_target={encoded redirect url}"</p>
  
  <p>whereupon the D2L server will immediately return a response of the form:</p>
  
  <p>{redirect url}?x_a={token id}&amp;x_b={token key}&amp;x_c={user identity signature}</p>
  
  <p>without requesting credentials from the user.  My questions are:</p>
  
  <p>If this is correct, how does the D2L server identify the user for which authentication 
  is being requested, since no user information is specified in the request?</p>
  
  <p>Is there some kind of session information that must be appended to the authentication request url, or that must accompany it in the form of cookies?</p>
  
  <p>If the description above is not correct, how does the External Learning Tool authenticate with the Valence API, given an LTI request? </p>