Q:

Authenticate a user into D2L using the APP ID and APP KEY

If you have authenticated with an APPID and APPKEY and a specific user (meaning when prompted the users username and password have been entered and authenticated) and the system has sent back a USERID and USERKEY.  Can you then make an API call to authenticate that user into D2L so the user arrives at the D2L MY HOME page?
In addition to that...
if the USERID and USERKEY for a specific user are stored in a DB, can you use that data alone to authenticate the user into D2L using an API call so the user arrives at the MY HOME page with no additional login prompt?
I understand that if the USERID and USERKEY have expired this would not work.

A:

There are several different issues in this question.
Active web session for a user. Currently, D2L's Valence platform's user authentication does not work this way. The LMS will only provide back a UserID/Key pair as part of the auth process when it can confirm that it has an active session with a user:

API-calling client makes a request directly to the LMS to retrieve a UserID/Key pair for a user.
a. If the LMS has an active session with a user, (generate if necessary and) return the UserID/Key pair for that application/user pair.
b. If the LMS does not have an active session with a user, go through the login process it has configured to authenticate a user: this could be to redirect the calling web request to the LMS' own user login page, or that redirection could go through a third-party service that the LMS uses to authenticate users (for example, a configured SSO IDP).

What this means: if you use the API to initiate the auth process to retrieve a UserID/Key pair, the calling web browser will (as part of that process) already have an active web-session with the LMS. Either the user will be asked to log in using whatever auth process the LMS uses for that, or the user will already have done so and the calling browser will know that (because it has cookie state indicating an active session).
Programmatic logins. Currently, D2L's Valence platform does not support direct participation in the user authentication process: there are no calls to authenticate the user with the LMS by providing a userid/password or any other secret shared between the user and the LMS. The Valence security model specifically seeks to avoid having the API-calling client know about the authentication secret shared between the user and the LMS.
A client using the Valence Learning Framework APIs needs to either:

Initiate the authentication process by requesting a UserID/Key pair from the LMS (in which case the LMS will seek to auth the user; see the previous answer)
Rebuild a user context by using a valid UserID/Key pair from a cached state that it has already gathered from the LMS (which, in turn, will have required a real user to authenticate with the LMS)

UserID/Key pair expiry. Note that these auth tokens provided to the calling client by the LMS are intended to be long-lived. They should out-last the current web session that a browser will have for the user. Thus, a client application should treat those as secure data especially in combination with the client application's own ID/Key pair (since the user ID/Key pair is bound app's own ID/Key pair). While we expect client applications to cache these authentication tokens, we also expect them to be cached as sensitive information.
A user's ID/Key pair generated for an application will expire when one of these events happens:

The arrival of the expiry time associated with the ID/Key pair when the LMS generated it (the LMS admins can ensure that the default expiry time value for these tokens is "indefinite")
The user's password changes (either by the user or an LMS admin resetting it)
An LMS admin manually revokes client app access for the user

