> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safeonlineexam.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Safe Online Exam: Canvas LTI App for Safe Exam Browser
> What Safe Online Exam does, who it serves, Version 1 features, the SEB protection flow, technology stack, stable routes, and PolyForm license terms.
Safe Online Exam is an LTI 1.3 application that connects a Canvas LMS tenant to Safe Exam Browser (SEB), enabling institutions to enforce a locked-down browser on Canvas Classic Quizzes and New Quizzes. This page introduces what the product does, who it is for, what Version 1 includes, how the protection flow works end-to-end, the technology stack it runs on, the stability contracts that Canvas and deployed clients depend on, and the project license.
## What It Does
Instructors decide which Canvas assessments require SEB. Students receive a purpose-built, certificate-encrypted `.seb` configuration file. The Canvas access code for each protected assessment is released only after SEB proves it is running the current configuration — a server-verified Config Key proof, not a browser-UI check.
One deployment connects to one Canvas tenant and environment. Use separate service URLs, databases, secrets, LTI installations, and OAuth credentials for production, test, beta, or independent Canvas instances.
Safe Online Exam adds technical controls around a Canvas assessment. It does not replace instructional planning, identity verification, accommodations, device management, proctoring, incident response, or a school's security and privacy review.
## Who It Is For
The four groups that interact with Safe Online Exam have distinct responsibilities:
| Role | Responsibility |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| **Canvas administrators** | Install the LTI and OAuth Developer Keys, load the detector through the Canvas theme, and operate the school dashboard. |
| **Infrastructure teams** | Deploy the service, PostgreSQL, secrets, backups, cleanup, monitoring, and the SEB client identity. |
| **Instructors** | Choose assessments, configure course policy and approved exam tools, and enable or disable SEB from Canvas. |
| **Students** | Connect Canvas once, run an optional setup check, and open each protected assessment in SEB. |
## What Version 1 Includes
* Canvas LTI 1.3 course navigation and root-account administration placements.
* Canvas OAuth with one durable per-user grant that carries the complete application scope set and upgrades in place for root-account administrators.
* Discovery and management of Classic Quizzes and New Quizzes.
* Course defaults, assessment overrides, start and exit passwords, URL rules, course exam tools, quiz-only tools, and school-managed tool presets.
* Certificate-encrypted `.seb` files by default, with an explicit instance-level compatibility mode when managed certificate distribution is not possible.
* Scoped Canvas session handoff into SEB without copying browser cookies.
* SEB Config Key proof, one-time access-code release, approved-tool release, and completion-bound exit.
* PostgreSQL-backed sessions, OAuth grants, settings, one-time state, admission limits, and distributed locks.
* Multi-architecture release images for `linux/amd64` and `linux/arm64`.
## How The Protection Flow Works
The sequence below traces a student's path from a Canvas course page to a completed SEB assessment. The enforcement boundaries are the generated SEB URL filter, the current configuration fingerprint, the server-side Config Key proof, and the Canvas-authored completion state — not the detector's buttons or sidebar.
```text theme={null}
Student → Canvas : Launches the LTI from a course
Canvas → App : Sends a signed LTI launch
App → Canvas : Requests a one-time Canvas session URL
App → Student : Issues a one-time configuration grant
Student → App : Downloads the current .seb configuration
Student → SEB : Opens the configuration
SEB → Canvas : Opens the assessment through the session handoff
SEB → App : Proves the current Config Key
App → SEB : Releases a one-time access code and approved tools
SEB → Canvas : Completes the assessment
App → SEB : Allows the settings-bound exit flow
```
## Technology Stack
| Component | Technology |
| ---------------- | --------------------------------------------------- |
| Runtime | Node.js 24 and npm 11 |
| Server framework | NestJS 11 on Express |
| Front-end | React 19 and Vite |
| Database | PostgreSQL 17 or newer |
| Testing | Vitest and Playwright |
| Production image | Nonroot distroless, `linux/amd64` and `linux/arm64` |
The runtime is provider-neutral: it requires PostgreSQL, a public HTTPS origin, secret injection, a migration job before application traffic, and scheduled cleanup. The two maintained deployment targets are Docker Compose and Google Cloud Run with Cloud SQL. Google Cloud Run with Cloud SQL is the recommended managed deployment; Docker Compose is the maintained self-hosted alternative.
## Compatibility Contracts
Canvas and deployed SEB clients depend on the following stable public routes. Treat any change to these routes, content IDs, migrations, or configuration keys as a compatibility change that requires a versioned release.
```text theme={null}
GET /lti/config
GET|POST /lti/login
GET|POST /lti/launch
GET /.well-known/jwks.json
GET /health
GET /ready
GET /js/canvas-seb-detector.js
GET /js/canvas-seb-theme-loader.js
GET /api/seb/canvas-detector.js
GET /api/seb/requirement/:courseId/:quizId
GET /api/oauth2callback
GET /seb/config/:courseId/:contentId.seb
```
Content IDs are also part of the compatibility contract:
| Assessment type | Canonical content ID format |
| --------------- | ----------------------------------- |
| Classic Quiz | `classicquiz_{quizId}` |
| New Quiz | `newquiz:{courseId}:{assignmentId}` |
## License
Safe Online Exam is source-available under the **PolyForm Noncommercial License 1.0.0** — not an OSI-approved open-source license. Eligible institutions may self-host and modify it for permitted noncommercial use. Commercial hosting, implementation, support, resale, and competing services require separate permission. Review the commercial licensing document, contributing guide, third-party notices, and trademark guidance before redistribution or commercial use.
## Next Steps
Choose Docker Compose or Google Cloud Run and prepare your infrastructure before registering the application in Canvas.
Register the OAuth Developer Key, LTI Developer Key, and Canvas theme loader to connect Safe Online Exam to your Canvas tenant.
Review every environment variable, secret, and validation rule before your first deployed install.
Understand the runtime shape, trust boundaries, identity model, SEB lifecycle, and persistence design.