Your Canvas calendar feed URL is a credential

Treat your Canvas calendar feed URL like a password. Somewhere in that URL is an opaque per-user token — on Canvas it sits in the path itself, as the user_... segment of .../feeds/calendars/user_....ics; some other schools' and services' feeds put it in a query parameter instead — and that token is the part that identifies you. In building Margin's feed handling we treat the whole feed URL, path and query alike, as identity-bearing for exactly this reason. Students paste these URLs into forums, help-desk tickets, shared documents, and group chats all the time without realizing it. Never post yours anywhere public.

What this looks like from a student's side

Nothing. That is the whole problem with it.

A feed URL does not look like a secret. It is a long, ugly, machine-shaped string that reads like plumbing rather than like a password, and the place you meet it is a "copy this link" box next to instructions for setting up your calendar. Most setup flows never ask you to protect it. When the calendar subscription fails to work, the natural next move is to paste the link into a question — on Reddit, in a campus Discord, in a ticket to IT, into a support chat with a third-party app — so that whoever is helping can see what is wrong.

In Margin's feed handling, the URL is all a fetch needs: there is no login step in the request we make, and nothing else in that request establishes who is asking. So anyone holding the link can make the same request and get the same answer: your class schedule — which courses you are enrolled in, what is due, and when. And unlike a password you can change after an awkward moment, a link that has been indexed or screenshotted is very hard to take back.

Why the URL works this way

A calendar subscription is a plain, unauthenticated fetch. Your calendar app is not signed in to Canvas and cannot be asked to log in — it requests a URL on a schedule and expects an .ics file back. So the credential has to travel inside the URL itself. That constraint is inherent to the format, not a Canvas choice; where the token sits in the URL is the only part that varies.

The consequence is worth stating plainly: possession is authorization. Anything that ends up holding the URL — a browser history, a link preview, a chat log, a pasted screenshot, an app you gave it to — holds the ability to read that feed, for as long as the token stays valid.

Two extra edges are worth knowing:

Some institutional feeds are served over plain http://. When they are, the token rides the network in the clear — and because the token is part of the URL rather than something sent after a login, there is no later step at which it gets protected.
URLs leak in ways passwords do not. They get shortened, previewed, auto-linked, saved into shared documents, and pasted into support tickets that live in a searchable system for years. Little in that chain treats them as a secret.

What you can do about it

Treat "copy the feed link" as "copy a password." If a step in a setup guide asks you to paste it somewhere, ask yourself who else can read that place.
Redact everything after the host — not everything after the ?. On a Canvas feed URL the secret is in the path, so cutting at a ? protects nothing (there usually is not one). Keep the origin and collapse the rest: https://school.instructure.com/feeds/calendars/[redacted].ics gives a helper every structural detail they need without handing over access. That is exactly what Margin's own logger does with any .ics URL that reaches it — collapse to the origin, replace the rest.
Prefer https:// when your institution offers both. If the URL you were given starts with http://, try the https:// form and use it if it works.
Be deliberate about which apps you hand it to. Any tool that reads the feed on your behalf holds a working credential for it. That is a reasonable trade for a tool you chose; it is not one to make casually.
If you think yours has already been shared, assume it still works. Stop using that feed for anything you would not want read, and ask your institution's Canvas administrators what your options are — feed-token handling is set at the institution level, and they are the people who can tell you what is actually available to you.
Do not let this scare you off calendar feeds. They are useful, and the distinction matters: a feed URL is a read-only subscription link, not a Canvas login.

Evidence

Margin's own code — where the secret lives. extension/http.js records that user-provided iCal feeds "embed a bearer SECRET in the URL PATH (Canvas .../feeds/calendars/user_<hex>.ics, Google .../private-<key>/basic.ics)", which the query-parameter redaction rules never strip; feed URLs are therefore reduced to their origin before they can enter an error message or log. This is our implementation and our reading of the feeds we handle, not a statement about how any vendor documents its own product. (Verified 30 July 2026.)
Margin's own code — the redaction rule this page recommends. extension/logger.js carries a dedicated rule that collapses any .ics URL to its origin plus /[REDACTED], added specifically because path-embedded feed secrets survive query-string scrubbing. The advice above is the same rule, done by hand. (Verified 30 July 2026.)
Margin's own code — treating the query as identity-bearing too. extension/sanitize.js deliberately excludes the query string from feed-URL normalization, on the recorded ground that "school feed URLs carry per-user signed tokens"; the query is kept verbatim so a different query is treated as a different feed. This covers feeds that do carry a query token; it is not evidence that Canvas feeds do. (Verified 30 July 2026.)
Margin's internal beta failure-mode audit, 22 June 2026 — records the http:// case as "iCal URL ships embedded credentials in clear," mitigated by a validator warning surfaced in health output, and deliberately warned rather than blocked because some legitimate private feeds are served over http. (Verified 30 July 2026.)
Not cited here: Instructure's own calendar-feed documentation. We could not retrieve it in a form we could quote at drafting time, so this page makes no claim about what Instructure documents — including any claim about whether a reset path exists, whether Canvas notifies or logs feed access, or what a leaked feed URL can and cannot reach.