Environment Configuration

All configuration is done through environment variables in the .env file.

Complete .env Template

# ============================================
# SERVER CONFIGURATION
# ============================================
PORT=3000
SECRET=your-secure-random-string-here

# ============================================
# LTI 1.3 CONFIGURATION (from D2L Admin)
# ============================================
LTI_CLIENT_ID=your-client-id-from-d2l
LTI_DEPLOYMENT_ID=your-deployment-id-from-d2l

# ============================================
# GRADESCOPE CREDENTIALS (Instructor Account)
# ============================================
TOKEN=your-gradescope-authenticity-token
COOKIE=your-gradescope-session-cookie

# ============================================
# GRADESCOPE COURSE INFO
# ============================================
COURSE_ID=1106756

# ============================================
# OPTIONAL: DEBUG MODE
# ============================================
DEBUG=false

Variable Reference

Server Configuration

Variable	Required	Default	Description
PORT	No	3000	HTTP server port
SECRET	Yes	—	Secret key for signing tokens. Use a long random string (32+ characters)

Generating a Secret

node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

LTI Configuration

Variable	Required	Description
LTI_CLIENT_ID	Yes	Client ID from D2L LTI registration
LTI_DEPLOYMENT_ID	Yes	Deployment ID from D2L LTI registration

These values come from your D2L administrator after registering the LTI tool. See D2L Integration.

Gradescope Credentials

Variable	Required	Description
TOKEN	Yes	Gradescope authenticity token (CSRF token)
COOKIE	Yes	Gradescope session cookie
COURSE_ID	Yes	Your Gradescope course ID (from URL)

Credential Expiration

Gradescope sessions expire periodically. You'll need to update TOKEN and COOKIE when submissions start failing.

Getting Gradescope Credentials

Method 1: Browser Developer Tools

1. Log into Gradescope as an instructor
2. Open Developer Tools (F12 or right-click → Inspect)
3. Go to the Network tab
4. Navigate to any assignment page
5. Click on any request to gradescope.com
6. In Headers, find:
   • Cookie: Copy the entire cookie string
   • Look for authenticity_token in form data or page source

Method 2: Browser Console

1. Log into Gradescope
2. Open Developer Tools → Console
3. Run:

// Get cookie
document.cookie

// Get authenticity token (if on a form page)
document.querySelector('input[name="authenticity_token"]')?.value

Finding Your Course ID

Your course ID is in the Gradescope URL:

https://www.gradescope.com/courses/1106756
                                    ^^^^^^^
                                    This is your COURSE_ID

Security Best Practices

Never Commit .env

The .env file contains sensitive credentials. Never commit it to version control.

1. Add to .gitignore — Already done in the repository
2. Use environment variables on production — Set via your hosting provider
3. Rotate credentials — Update Gradescope credentials monthly
4. Strong SECRET — Use a cryptographically random string

Updating Credentials

When Gradescope sessions expire:

1. Log into Gradescope again
2. Get fresh TOKEN and COOKIE values
3. Update your .env file
4. Restart the server:

pm2 restart gradescope-submitter