.seb configuration, and the Canvas access code is released only after SEB proves it is running the current configuration — without any browser cookie being copied or shared.
Introduction
Understand the project, its roles, and what Version 1 includes before deploying.
Architecture
Explore the system components, identity model, trust boundaries, and route reference.
Deployment
Choose between Docker Compose and Google Cloud Run, then follow the installation steps.
Canvas Setup
Create the API OAuth Developer Key and LTI registration in Canvas.
Configuration Reference
Every environment variable, its default, and its validation requirements.
Certificate Management
Generate, configure, and rotate the SEB configuration-encryption identity.
Who Is This For?
Canvas Administrators
Install the LTI and OAuth Developer Keys, operate the school dashboard, connect courses, and manage school exam tool presets.
Infrastructure Teams
Deploy the service, provision PostgreSQL, manage secrets, configure backups, and operate scheduled cleanup.
Instructors
Choose assessments, configure course policy and approved exam tools, and enable or disable SEB from Canvas.
Students
Connect Canvas once, run an optional setup check, and open each protected assessment in Safe Exam Browser.
How It Works
1
Deploy the service
Install a versioned release bundle on Docker Compose or Google Cloud Run with Cloud SQL. The service needs PostgreSQL 17+, a public HTTPS origin, and secrets injection.
2
Register in Canvas
Create a Canvas API OAuth Developer Key and an LTI 1.3 Developer Key, install the external app in your root account, and load the Canvas theme detector script.
3
Generate the SEB identity
Run the certificate generator, store the public certificate in your secret manager, and distribute the private
.p12 identity to approved student devices via MDM.4
Enable SEB on assessments
Instructors open the Safe Online Exam course navigation item, connect Canvas, discover quizzes, and enable SEB — the access code is set automatically.
5
Students take assessments
Students launch Safe Online Exam, download the encrypted
.seb configuration, open it in SEB, and the access code is released only after Config Key proof passes.Safe Online Exam adds technical controls around a Canvas assessment. It does not replace identity verification, accommodations, device management, proctoring, incident response, or your institution’s security and privacy review.
API Reference
LTI Routes
OIDC initiation, launch handling, and JWKS endpoints
SEB Student Routes
Config grants, access-code proof and redemption, and exit flows
Admin Routes
Course connections, resets, tool presets, and school rollout