It is not really clear to me if it had privileged access to answers or if it saw the same material a student would see reading through the syllabus + assigned readings.
Previously, students had to download the PDFs and manually upload them. If students gave eightball their API tokens, eightball could fetch their course materials on their behalf.
Perhaps I'm missing something, but that's how it reads to me.
in pretty much every single system's terms, providing someone else your tokens or other forms of sharing of credentials is expressly forbidden. this is why I am flabbergasted things like Plaid work. I will never provide a 3rd party my credentials to anything but damn sure not something like a bank or credit card.
Plaid uses OAuth for many of their connections and doesn’t violate ToS in that case. There usually are TOS related to not sharing your password and disclaiming liability if you do.
Just a wild guess, but maybe the IT department gets charged an additional fee from Canvas based on the usage of API tokens?
Conflicts like these are always about money, one way or another.
Edit: I'm not sure if I just missed it earlier or the article has been updated, but this issue is directly addressed now:
> The students were also accused of “disseminating course material” by allowing students to use their own, individualized Canvas API tokens to connect Eightball directly so they did not have to upload PDFs to the tool themselves. “The upgrade did not change what students could upload to Eightball or what learning materials Eightball could produce upon request,” the suspended students’ lawyers note in the lawsuit.