Panopto REST API: CORS & Auth in Brightspace Widget

Kabir Hussain

We are developing a custom HTML/JS widget hosted inside Brightspace (D2L). The goal of the widget is to allow students to run keyword searches across Brightspace course content, discussion tools, and News items, while also searching Panopto video transcripts within the course using the Panopto REST API endpoint:

GET /Panopto/api/v1/sessions/search?searchQuery={query}

Since this widget runs directly in the browser on the Brightspace domain, we are encountering two main technical challenges:

1. CORS Error: Browser-initiated fetch requests from Brightspace to our Panopto site are blocked because Access-Control-Allow-Origin does not allow our Brightspace domain.
2. Authentication (401 Unauthorized): Because this is a client-side widget, we need a way to securely pass or obtain user context to execute searches on behalf of the logged-in student.

Questions:

1. CORS: Is there a supported way (or configuration in Panopto settings) to whitelist cross-origin requests coming from our Brightspace domain for client-side calls?
2. User Authentication: What is the recommended OAuth2 flow or token exchange strategy for a client-side LMS widget to authenticate against the REST API on behalf of the current user?

Any guidance or reference patterns would be greatly appreciated!

Adis Hrnjica

Hi Kabir,

Here are the responses to your questions, let me know if you need additional info.

CORS

• Yes. Add the Brightspace origin to System Settings → Security → Allowed API Origins (space-separated full origins, e.g. https://your-institution.brightspace.com)
• Leave Limit Cross-Origin Requests to Known Origins enabled
• The OAuth client’s CORS Origin URL does not unlock /api/v1. That is a separate site setting
• Call the API with Authorization: Bearer {token}. Do not use Panopto cookies from Brightspace

Auth (401)

• The search API needs a Panopto user token. Brightspace cookies, Valence, and LTI are not accepted on that endpoint
• There is no LMS → Panopto token exchange. The student must go through Panopto OAuth (SSO via D2L IdP still requires an authorize redirect)
• Do not use client credentials. Search must run as the student

Recommended approach

• Best: a small backend that does authorization code (server-side web app), then calls Panopto with the student’s token
• Browser-only: authorization code + PKCE (Mobile or Desktop Application), popup redirect, then Bearer calls. Implicit exists for SPAs but is weaker
• Alternative: LTI iframe into Panopto instead of REST from Brightspace

Search

• /api/v1/sessions/search is site-wide, not course-scoped
• For a course, use /api/v1/folders/{folderId}/sessions/search and includeFields=Context for transcript snippets

I hope this helps.

Thanks,

Adis