It's the latter. It sounds like they got suspended because they told their users (i.e students) to give them their canvas API tokens so that they could fetch course materials on their behalf.

Previously, students had to download the PDFs and manually upload them. If students gave eightball their API tokens, eightball could fetch their course materials on their behalf.

Perhaps I'm missing something, but that's how it reads to me.

> give them their canvas API tokens

in pretty much every single system's terms, providing someone else your tokens or other forms of sharing of credentials is expressly forbidden. this is why I am flabbergasted things like Plaid work. I will never provide a 3rd party my credentials to anything but damn sure not something like a bank or credit card.

There are many systems that allow generating a API token to be used with other apps. The article clearly indicates that this school learning system, “Canvas”, had such a functionality until it was removed during this saga, apparently by hiding it with CSS or something since there was an “inspect element” workaround to still access it.

Plaid uses OAuth for many of their connections and doesn’t violate ToS in that case. There usually are TOS related to not sharing your password and disclaiming liability if you do.

3rd party access is the entire point of API tokens. Use cases like this are why Canvas has them.

From TFA: <<university’s IT department was angry that the company allowed students to connect their own Canvas API tokens to the app>>

Just a wild guess, but maybe the IT department gets charged an additional fee from Canvas based on the usage of API tokens?

Conflicts like these are always about money, one way or another.

Conflicts in bureaucracies like universities are often petty power struggles rather than anything financial. Especially between IT departments and anyone else.

I think it is pretty clear they did not have privileged access. Either because they never connected to the courseware service, or because they did so with students' credentials.

Edit: I'm not sure if I just missed it earlier or the article has been updated, but this issue is directly addressed now:

> The students were also accused of “disseminating course material” by allowing students to use their own, individualized Canvas API tokens to connect Eightball directly so they did not have to upload PDFs to the tool themselves. “The upgrade did not change what students could upload to Eightball or what learning materials Eightball could produce upon request,” the suspended students’ lawyers note in the lawsuit.