> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safeonlineexam.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Safe Online Exam: Secure Canvas Testing with Safe Exam Browser

> Safe Online Exam is an LTI 1.3 app that connects Canvas LMS to Safe Exam Browser, enforcing secure browser requirements on Classic Quizzes and New Quizzes.

Safe Online Exam helps institutions run Canvas assessments inside [Safe Exam Browser (SEB)](https://safeexambrowser.org/). Instructors choose which quizzes require SEB, students receive a purpose-built encrypted `.seb` configuration, and the Canvas access code is released only after SEB proves it is running the current configuration — without any browser cookie being copied or shared.

<CardGroup cols={2}>
  <Card title="Introduction" icon="book-open" href="/introduction">
    Understand the project, its roles, and what Version 1 includes before deploying.
  </Card>

  <Card title="Architecture" icon="diagram-project" href="/architecture">
    Explore the system components, identity model, trust boundaries, and route reference.
  </Card>

  <Card title="Deployment" icon="server" href="/deployment/overview">
    Choose between Docker Compose and Google Cloud Run, then follow the installation steps.
  </Card>

  <Card title="Canvas Setup" icon="graduation-cap" href="/deployment/canvas-setup">
    Create the API OAuth Developer Key and LTI registration in Canvas.
  </Card>

  <Card title="Configuration Reference" icon="sliders" href="/configuration/reference">
    Every environment variable, its default, and its validation requirements.
  </Card>

  <Card title="Certificate Management" icon="certificate" href="/deployment/certificate-management">
    Generate, configure, and rotate the SEB configuration-encryption identity.
  </Card>
</CardGroup>

## Who Is This For?

<CardGroup cols={2}>
  <Card title="Canvas Administrators" icon="user-shield" href="/user-guide/administrators">
    Install the LTI and OAuth Developer Keys, operate the school dashboard, connect courses, and manage school exam tool presets.
  </Card>

  <Card title="Infrastructure Teams" icon="gear" href="/deployment/overview">
    Deploy the service, provision PostgreSQL, manage secrets, configure backups, and operate scheduled cleanup.
  </Card>

  <Card title="Instructors" icon="chalkboard-teacher" href="/user-guide/instructors">
    Choose assessments, configure course policy and approved exam tools, and enable or disable SEB from Canvas.
  </Card>

  <Card title="Students" icon="user-graduate" href="/user-guide/students">
    Connect Canvas once, run an optional setup check, and open each protected assessment in Safe Exam Browser.
  </Card>
</CardGroup>

## How It Works

<Steps>
  <Step title="Deploy the service">
    Install a versioned release bundle on Docker Compose or Google Cloud Run with Cloud SQL. The service needs PostgreSQL 17+, a public HTTPS origin, and secrets injection.
  </Step>

  <Step title="Register in Canvas">
    Create a Canvas API OAuth Developer Key and an LTI 1.3 Developer Key, install the external app in your root account, and load the Canvas theme detector script.
  </Step>

  <Step title="Generate the SEB identity">
    Run the certificate generator, store the public certificate in your secret manager, and distribute the private `.p12` identity to approved student devices via MDM.
  </Step>

  <Step title="Enable SEB on assessments">
    Instructors open the Safe Online Exam course navigation item, connect Canvas, discover quizzes, and enable SEB — the access code is set automatically.
  </Step>

  <Step title="Students take assessments">
    Students launch Safe Online Exam, download the encrypted `.seb` configuration, open it in SEB, and the access code is released only after Config Key proof passes.
  </Step>
</Steps>

<Note>
  Safe Online Exam adds technical controls around a Canvas assessment. It does not replace identity verification, accommodations, device management, proctoring, incident response, or your institution's security and privacy review.
</Note>

## API Reference

<CardGroup cols={3}>
  <Card title="LTI Routes" icon="key" href="/api/lti-routes">
    OIDC initiation, launch handling, and JWKS endpoints
  </Card>

  <Card title="SEB Student Routes" icon="shield-check" href="/api/seb-student-routes">
    Config grants, access-code proof and redemption, and exit flows
  </Card>

  <Card title="Admin Routes" icon="building-columns" href="/api/admin-routes">
    Course connections, resets, tool presets, and school rollout
  </Card>
</CardGroup>