Skip to main content
Safe Online Exam gives instructors full control over which Canvas assessments require Safe Exam Browser and how those assessments are configured. This page walks through every step of the instructor workflow — from opening the course navigation item for the first time through per-assessment overrides, exam tool management, and disabling SEB.
The server enforces access using signed LTI course and role claims. Changing a course ID in a browser URL does not authorize access to another course.

​
Canvas Authorization

Canvas LTI identity and Canvas API authorization are separate. The first time an instructor needs Canvas API access, Safe Online Exam displays a Connect Canvas prompt. Authorization runs in a popup while the signed LTI page remains open. The OAuth callback renders a non-privileged completion screen and sends a fixed completion message to the opener; the opener verifies both the message origin and the popup window before performing its own same-origin refresh. Use Reconnect Canvas if scopes, credentials, or Canvas permissions change.

​
Initial Course Setup

Open Safe Online Exam from the Canvas course-navigation menu to begin. If this is the first time the course has been configured, a guided four-stage setup sequence opens automatically.
1

Welcome

Review the short course-setup overview. Each stage must be valid before Continue advances to the next step.
2

Set an Exit Password

Set a course exit password when the course does not already have effective managed protection from a school preset. This password protects native early quit from SEB — it is not a Canvas access code.Passwords must be 8–128 characters (after trimming surrounding spaces), contain at least five different letters or numbers, contain no control characters or line breaks, and avoid common words, sequences, and repeated patterns. Password fields show the same live requirements enforced by the server.
3

Configure Exam Tools (Optional)

Enable only the approved web resources students need during the assessment. This step is optional when an assessment requires no additional tools.
4

Enable a First Assessment

Save the course policy, then enable SEB on at least one assessment from the discovered quiz list.
Course policy remains fully editable from Course settings after onboarding completes.
Course defaults cascade to all assessments. Configure your exit password, start password (if needed), and exam tools at the course level first — individual assessments inherit these settings unless explicitly overridden.

​
Discovering Quizzes

Select the Refresh action whenever Canvas quizzes have been created, renamed, published, unpublished, or changed outside Safe Online Exam. The service discovers:
  • Classic Quizzes through the Canvas REST API
  • New Quizzes through the assignment and New Quiz APIs
For a student to launch an assessment, the cached metadata must be currently verified, published, and within Canvas’s configured unlock and lock window. Discovery fails closed — stale or failed metadata is never trusted for student launch.

​
Configuring Course Policy

Course settings provides defaults that apply to every assessment unless explicitly overridden:
  • An optional start password that protects the inner .seb payload — it is a second check before the assessment opens and does not replace certificate encryption, Canvas authentication, or Config Key proof
  • The required effective exit password that protects native early quit from SEB
  • Allowed URL rules under Advanced website access for resources that no exam tool covers
  • The course exam-tool catalog shared across all assessments
Do not reuse the same value for the start password and the exit password. Use Advanced website access URL rules only when no approved exam tool can satisfy the resource requirement; the normal course setup flow does not request URL rules.

​
Adding and Managing Exam Tools

An exam tool is an exact HTTPS launch page paired with a deliberate resource policy. When creating a tool, choose the most restrictive scope that meets the assessment’s needs: Add cross-site resources such as CDN hosts or embedded-content origins only when the tool genuinely requires them. The generated SEB URL filter — not the visible sidebar — is the enforcement boundary that controls what the SEB client can load.
The SEB URL filter is the true enforcement boundary. The sidebar in the SEB interface is a user-interface affordance only and does not determine what the client is permitted to load.

​
YouTube Video Tool

Use the dedicated YouTube-video option to share one public video with students. It accepts a watch, share, Shorts, or embed link and converts it into a server-owned embedded player page. It does not permit general YouTube browsing or Google sign-in. The server-owned player page supplies YouTube’s required embedding identity while deliberately excluding broader YouTube access.

​
Copying a Tool to Other Courses

Instructor-owned course tools can be duplicated to other active courses where the same Canvas user holds the teacher role.
1

Open the Tool

Open the tool you want to duplicate and choose Duplicate to courses.
2

Select Target Courses

Select one or more eligible target courses from the Canvas-filtered list. The server retrieves the teacher-course list again immediately before writing and snapshots each target’s reset generation before those reads. If a course reset completed in the meantime, or if reset-deleted course setup has not yet been recreated by a teacher launch, the copy is rejected for that target.
3

Confirm the Result

Review the copy result. Copying appends an equivalent tool to the target catalog without replacing existing tools and is safe to retry.
School-managed presets and quiz-only tools cannot be duplicated using this flow.

​
Per-Assessment Overrides

Open any assessment’s settings to configure it independently from course defaults:
  • Inherit course-level start and exit passwords, or set assessment-specific values
  • Select a subset of the course exam-tool catalog for this assessment
  • Add tools that apply only to this assessment (quiz-only tools never become course defaults)
  • Add assessment-specific URL rules under Advanced website access
Selecting no course tools for an assessment is a valid, explicit policy. Any protected-policy change — password, tool, URL rule, certificate, or relevant service setting — changes the configuration fingerprint. Students must download a fresh .seb file after any such change.

​
Enabling and Disabling SEB

​
Enabling SEB

Enabling SEB on an assessment requires an effective exit password to be set. When you enable SEB, the service:
  1. Generates a new Canvas access code
  2. Updates the appropriate Classic Quiz or New Quiz in Canvas
  3. Persists the SEB policy locally only after Canvas accepts the change
  4. Exposes the assessment on the student launch list
Routine instructor responses do not return the access code. Use the explicit, short-lived password reveal only for authorized recovery.

​
Disabling SEB

Disabling SEB removes the Safe Online Exam requirement through the corresponding Canvas API and updates local state. If an upstream Canvas error occurs during disable, verify the Canvas assessment directly rather than manually editing both systems in parallel.

​
Regenerating the Access Code

You can regenerate the Canvas access code for any SEB-enabled assessment independently of disabling and re-enabling SEB. After regeneration, students must obtain the new code through SEB’s Config Key proof flow — the old code is immediately invalid.

Student Workflow

See how students connect Canvas, download configurations, and launch protected assessments.

Administrator Workflow

Learn how administrators connect courses, assign school presets, and perform recovery actions.

LTI Settings

Review the LTI placement and claim settings that drive instructor course access.

Troubleshooting

Diagnose quiz-discovery failures, Canvas API errors, and SEB configuration issues.