JWKS issue when deploying M365 LTI app

Jared.B.610

We have a newly deployed Brightspace instance (brightspace.spst.edu) and are configuring LTI Advantage (LTI 1.3) integrations for the first time. Our JWKS endpoint is returning — an empty keys array.

We have successfully registered tools under Manage Extensibility > LTI Advantage, created deployments, and even completed a test LTI launch for Zoom, but the JWKS endpoint remains empty. There is no support contract on this account. Has anyone encountered this on a new instance, and is there a way to trigger key generation from the admin side?

Many thanks,
Jared Brunk

Raquel.B.1893

Hi Jared,

You’re on the right track here — and what you’re seeing can happen on newly provisioned environments.

In theory, the JWKS should be populated once a tool registration + deployment exists, but in practice, there’s a second trigger involved: the signing service needs to initialize, which sometimes only happens after the first successful LTI 1.3 launch.

That’s where it gets tricky in cases like yours — if the JWKS is empty, validation may fail before you ever get a successful launch, so it never “self-initializes.”

A couple of things you can try:

• Double-check that the deployment is fully saved and assigned to org units (incomplete deployments can prevent key generation)
• If possible, register a simple test LTI 1.3 tool and launch it once — even a basic test tool can be enough to trigger key generation

If you still get {"keys":[]} after that, it’s very likely the JWKS/signing service just hasn’t been initialized on the backend yet, which can happen on brand new instances. In those cases, it isn’t something that can be triggered from the admin side and usually needs D2L to enable it.

Hope that helps — would be great to hear what ends up resolving it on your side.
Let me know if you have any doubts.

Raquel