It grants exactly what you already have, and nothing else. The useful detail is in what that includes, what it excludes, and why Canvas keeps shortening its life.
Short answer
A token is a long string that identifies you to Canvas without a password, so software can read Canvas on your behalf. Instructure states the scope in one sentence: it "allows the access token holder to access the same Canvas resources that you can access". Not more. It cannot reach courses you are not enrolled on and it is not a way to log in as you.
Make one under Account, then Settings, then + New Access Token. Canvas now requires a purpose and an expiry date, and caps how far ahead that can be, so a token is something you renew rather than set once. Delete it from the same page whenever you want; it stops working immediately.
On this page
Sooner or later a Canvas tool asks for an access token, and the question underneath is always the same one: how much am I handing over?
Instructure answers it in a single sentence, and it is worth reading twice.
A token is a long string of characters that identifies you to Canvas without a password. Software sends it with each request. Canvas checks it and answers as though you had asked in a browser.
From Instructure's own documentation: "Using the Canvas API allows the access token holder to access the same Canvas resources that you can access."
The same resources. Nothing extra. A token gives nobody a teacher view and reaches no course you are not enrolled on. It is your own access, handed to you in a form a program can use, and that is all it is.
You already rely on this without thinking about it. The Canvas mobile app holds one. So does every calendar feed, every plagiarism checker your university has wired in, every integration on the Approved Integrations list in your own settings. Go and look at that list; you will probably find several you never knowingly approved.
Worth being specific, because the vague fear is usually worse than the real limits.
What a token can do is everything you can do, which includes submitting work and posting to discussions. That is the real risk, and it is a risk about the software you paste it into rather than about tokens as an idea.
Canvas tokens used to last forever. Most guides still say to leave the expiry field blank, and Instructure's own help video still demonstrates it. That advice is out of date, and it went out of date in stages.
Instructure walked through the changes in its own product blog:
Do not take those numbers as your numbers. A real student account checked in August 2026 was offered 90 days, not 30, having previously been offered 120. The announcement and the settings page disagreed, and the settings page is the one that counts.
The mechanism is in the same post, and it is about roles rather than institutions. The short cap applies to "users with only student roles", and Instructure notes that a longer life "can be achieved by giving the user any role other than student (even with all permissions locked down)". Universities hand out extra roles constantly. A TA enrolment, a designer role on one module, a library or induction course you were added to as something other than a student: any of those can be why your page offers more time than the headline says.
So the honest version is that the direction is one way and shortening, the exact figure is whatever your own page offers you, and a tool that reads Canvas on your behalf will need a fresh token every month or quarter. That is Canvas working as designed, not the tool failing.
The reason is stated openly, and it isn't really about downloading. Instructure's post says: "we have seen an uptick in students setting up AI integrations to automatically review and complete assignments on their behalf". The tightening is aimed at homework bots. Everything else that reads Canvas through a token pays for it, which is annoying and also fairly reasonable.
The same Instructure page that explains tokens carries this: "It is a violation of Canvas API policy for a user to generate an access token to insert into an application. Applications must use approved authentication methods instead."
Read plainly, that covers what every Canvas download tool asks you to do, this one included. It deserves a straight answer rather than a footnote.
The approved method is OAuth, and OAuth needs a developer key. Canvas's API documentation is clear about where those come from: "developer keys are issued by the admin of the institution", and each key is scoped to the institution that issued it.
Which means an independent tool cannot simply comply. There is no central registry to apply to. A tool serving students at four thousand universities would need four thousand separate keys, each one requested from an administrator who has no particular reason to answer. Meanwhile Canvas puts a + New Access Token button in every student's settings page and always has.
That gap is why user tokens are how essentially every independent Canvas tool works, from research scripts to browser extensions. That is the situation rather than an excuse for it, and three things follow:
Some have. A student in Instructure's own community thread on downloading a course put it plainly: "Previously, I used access tokens to run an application for downloading the files, but my school has recently removed that feature."
If the + New Access Token button is missing from Account then Settings, that is what has happened, and no API-based tool can work around it. Two routes survive. The ones built into Canvas - Download as Zip and the other built-in methods for files, and the offline HTML export for the parts that are not files. And browser extensions, which ride the Canvas session your browser already has and never touch a token: see how the download tools compare.
Instructure's guidance is one line: treat a token "with the same level of security as your account password". In practice that comes down to four habits.
That last one is the part people forget. A token you deleted cannot be misused by anything, including by software you have stopped trusting. If you ever have a doubt, delete first and ask afterwards; the cost is generating a new one.
Being concrete, since a page about trust that stays vague is not worth much.
Canvas's expiry applies here like anywhere else. The app remembers the token so you are not retyping it, and when Canvas expires it the app says so and sends you to the right page.
Canvas Downloader uses your token to do one thing: read the courses you are already enrolled on and write them to a folder you choose. Every course in one run, with the slides, the readings, the Panopto lecture recordings, the quizzes, the discussions and the feedback you were given.
Free and open source, Windows and macOS. It reads and never writes, there is no account and no server, and the token never leaves your machine.
Exactly what you can do, and nothing else. Instructure puts it as "the same Canvas resources that you can access", so a token cannot reach courses you are not on or give anyone a teacher view. It can do the things you can do, though, including submitting work, which is why it is worth treating like a password.
No. It cannot be used to log in as you, it will not let anyone change your password, and Canvas shows it exactly once when you create it. Instructure still says to guard it as carefully as a password, because anything holding it can act as you inside Canvas.
Because Canvas now requires an expiry date. Users with only student roles were capped at 120 days in October 2025, and Instructure's July 2026 update gives 90 days for instructor tokens and 30 for student ones. Your own page may offer something different - a real student account checked in August 2026 was offered 90 - because the short cap applies only to accounts holding nothing but student roles, and an extra role anywhere lifts it. Whatever the number, expect to make a new token periodically.
Instructure said so directly: it had seen "an uptick in students setting up AI integrations to automatically review and complete assignments on their behalf". The restrictions are aimed at homework automation. Tools that only read your own material pay the same price.
Your institution has switched off token generation for students, which administrators have been able to do since September 2025. Nothing works around it. What is left is the routes built into Canvas: Download as Zip for a course's Files tab, and the offline HTML export from the Modules page if your institution allows that one.
Instructure's documentation says applications should use approved authentication instead, meaning OAuth. The difficulty is that OAuth needs a developer key, and Canvas's API docs say those "are issued by the admin of the institution" and are scoped to it - so an independent tool would need one from every university separately. That is why user tokens are how nearly every independent Canvas tool works. If your institution offers an approved route, use that instead.
Account, then Settings, then find it under Approved Integrations and click the bin icon. It stops working immediately. If you suspect a token has been exposed, delete it first and work out what happened afterwards - making a new one takes under a minute.
Yes. Since October 2025 administrators can view every user-generated token on an account, read the purpose you set for it, and delete any of them. Tokens are not a way to do anything quietly, and it is better to know that than to assume otherwise.