Canvas LMS Integration

Overview

This page covers the Canvas-specific install of the universal NotAI pixel. The pixel is install-anywhere. Canvas has its own install shape because the Theme Editor accepts JavaScript file uploads rather than raw HTML, so the pixel is attached via a small DOM-injection snippet instead of a <script> tag. The runtime behavior is identical to any other install.

Once the theme upload is live, the pixel observes behavioral signals on every Canvas page and reports them to your NotAI dashboard. Reviewer features that attribute sessions to specific students are an Academic Institutions offering and are configured from inside your dashboard once the pixel is reporting. See Reviewer Features.

Requirements

• Canvas admin access. You need account-level admin to upload a custom theme JavaScript file.
• NotAI account and integration ID. Sign up to get your 8-character integration ID from the dashboard.
• Academic Institutions if you want the reviewer features (authorship overlays and session replay tied to specific students). See the pricing page.

Supported Canvas Versions

• Canvas Cloud (Instructure-hosted)
• Canvas Self-Hosted (all currently supported versions)

Installation

Install the NotAI pixel by uploading a theme JavaScript file in the Canvas Theme Editor. This works for both Canvas Cloud and self-hosted instances.

Step 1: Open the Theme Editor

1. Log in to Canvas as an administrator.
2. Navigate to Admin → [Your Account] → Themes.
3. Select your active theme, or create a new one that inherits from it.
4. Click Open in Theme Editor.

Step 2: Upload the NotAI theme JavaScript

In the Theme Editor, open the Upload tab and upload a JavaScript file with the following contents. Canvas serves this file on every page, so the pixel attaches automatically.

// NotAI pixel for Canvas LMS
(function() {
  const s = document.createElement('script');
  s.src = 'https://cdn.isnotai.com/api.js';
  s.async = true;
  s.setAttribute('data-key', 'a7f3c2e1');
  document.head.appendChild(s);
})();

Replace a7f3c2e1 with your 8-character integration ID from the NotAI dashboard.

Step 3: Save and apply the theme

1. Click Save Theme.
2. Click Apply Theme to activate the changes across your Canvas instance.
3. Open any Canvas page. The pixel begins reporting within seconds.

Configuration

The Canvas install accepts the same configuration as the universal pixel. Use setAttribute for the short attributes; pass a data-config JSON string for anything else.

Short attributes

JSON configuration

For everything else, set data-config to a JSON string. Use this when you need to set sampleRate, customize the text monitor editor allowlist, or pass any other option beyond the short attributes above.

(function() {
  const s = document.createElement('script');
  s.src = 'https://cdn.isnotai.com/api.js';
  s.async = true;
  s.setAttribute('data-config', JSON.stringify({
    integrationId: 'a7f3c2e1',
    region: 'us',
    sampleRate: 1.0
  }));
  document.head.appendChild(s);
})();

See the pixel configuration reference for the full list of JSON keys.

Text Monitoring

Text monitoring captures typing behavior inside Canvas editors (assignment submissions, discussion posts, quiz essay responses) to classify authorship at the session level. It is off by default. Enable it with either data-text or the JSON equivalent.

(function() {
  const s = document.createElement('script');
  s.src = 'https://cdn.isnotai.com/api.js';
  s.async = true;
  s.setAttribute('data-key', 'a7f3c2e1');
  s.setAttribute('data-text', '');
  document.head.appendChild(s);
})();

The default editor allowlist covers Canvas's rich content editor and the standard form surfaces. If your instance uses a custom editor plugin, pass extraSelectors via data-config. See the pixel text monitoring reference.

Reviewer Features

The pixel install above is all you need to detect AI agents and bots at the session level. Reviewer features (authorship overlays tied to specific students, full session replay for suspected essays, and the instructor-facing review console inside your NotAI dashboard) are reserved for Academic Institutions.

Setup is guided from your NotAI dashboard's admin area. There is no additional configuration required on this public install page, and no shared secret or endpoint you have to manage.

For pricing and eligibility, see the pricing page.

Testing

Verify the install after applying the theme.

Confirm the script loads

1. Open any Canvas page in your browser.
2. Open Developer Tools (F12 or Cmd+Option+I) and select the Network tab.
3. Filter by cdn.isnotai.com.
4. Confirm api.js loads with a 200 status.

Confirm sessions reach your dashboard

1. Log in to your NotAI dashboard.
2. Navigate to Sessions.
3. Look for sessions with a hostname that matches your Canvas domain (for example, yourschool.instructure.com).

Sessions appear within seconds of the first signal. If you do not see any, check the Troubleshooting section.

Dashboard

All Canvas sessions surface in the NotAI dashboard alongside sessions from any other integration. Each session carries a verdict (clean, suspicious, or bot) and the signal evidence behind it. For Academic Institutions, reviewer features add authorship overlays and session replay inside the dashboard itself.

Session data is also available through the public retrieval API, documented at /developers.

Content Security Policy

Canvas does not set a default Content Security Policy that blocks the NotAI pixel. If your institution has added a custom CSP at a proxy or WAF in front of Canvas, allow the script host and the reporting host for your region.

United States

Content-Security-Policy:
  script-src 'self' https://cdn.isnotai.com;
  connect-src 'self' https://chl.isnot.ai wss://chl.isnot.ai;

European Union

Content-Security-Policy:
  script-src 'self' https://cdn.isnotai.com;
  connect-src 'self' https://chl-eu.isnot.ai wss://chl-eu.isnot.ai;

Only the reporting host differs between regions. Both regions use the same script host.

Troubleshooting

Pixel does not load

• Confirm data-key matches the integration ID from your NotAI dashboard exactly.
• Confirm your Canvas domain (for example, yourschool.instructure.com) is on the authorized origins list for your integration. Add origins from Settings → Authorized Origins in your dashboard. Requests from origins outside the list are rejected.
• Confirm the theme is saved and applied. Saving without applying will not propagate the upload.
• Clear your browser cache and reload.
• Check the browser console for CSP violations.

Pixel loads but no sessions appear

• Confirm data-region matches the region configured for your account.
• If you set sampleRate, confirm it is high enough that sessions are not being dropped on the client.
• Confirm the dashboard is filtered to the correct integration.

Theme changes not appearing

• Ensure you clicked both Save Theme and Apply Theme.
• Wait a few minutes for changes to propagate.
• View the page in an incognito window to bypass browser caching.
• Check that no other theme is overriding the one you edited.

False positives

• Users with assistive technology can produce patterns that overlap with automation.
• Remote desktop sessions can surface bot-like pointer traces.
• Review ambiguous sessions in the dashboard before taking action.

Performance

• The script loads asynchronously and does not block Canvas page rendering.
• Use sampleRate only if necessary on high-volume instances. Sampling hides sessions from detection entirely; it does not sub-sample a session.