> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safeonlineexam.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Instructor Course Setup and SEB Management Workflow
> Connect Canvas, discover Classic and New Quizzes, configure SEB policy, manage exam tools, and enable or disable SEB protection per assessment.
Safe Online Exam gives instructors full control over which Canvas assessments require Safe Exam Browser and how those assessments are configured. This page walks through every step of the instructor workflow — from opening the course navigation item for the first time through per-assessment overrides, exam tool management, and disabling SEB.
The server enforces access using signed LTI course and role claims. Changing a course ID in a browser URL does not authorize access to another course.
***
## Canvas Authorization
Canvas LTI identity and Canvas API authorization are separate. The first time an instructor needs Canvas API access, Safe Online Exam displays a **Connect Canvas** prompt. Authorization runs in a popup while the signed LTI page remains open. The OAuth callback renders a non-privileged completion screen and sends a fixed completion message to the opener; the opener verifies both the message origin and the popup window before performing its own same-origin refresh. Use **Reconnect Canvas** if scopes, credentials, or Canvas permissions change.
***
## Initial Course Setup
Open **Safe Online Exam** from the Canvas course-navigation menu to begin. If this is the first time the course has been configured, a guided four-stage setup sequence opens automatically.
Review the short course-setup overview. Each stage must be valid before **Continue** advances to the next step.
Set a course exit password when the course does not already have effective managed protection from a school preset. This password protects native early quit from SEB — it is not a Canvas access code.
Passwords must be 8–128 characters (after trimming surrounding spaces), contain at least five different letters or numbers, contain no control characters or line breaks, and avoid common words, sequences, and repeated patterns. Password fields show the same live requirements enforced by the server.
Enable only the approved web resources students need during the assessment. This step is optional when an assessment requires no additional tools.
Save the course policy, then enable SEB on at least one assessment from the discovered quiz list.
Course policy remains fully editable from **Course settings** after onboarding completes.
Course defaults cascade to all assessments. Configure your exit password, start password (if needed), and exam tools at the course level first — individual assessments inherit these settings unless explicitly overridden.
***
## Discovering Quizzes
Select the **Refresh** action whenever Canvas quizzes have been created, renamed, published, unpublished, or changed outside Safe Online Exam. The service discovers:
* **Classic Quizzes** through the Canvas REST API
* **New Quizzes** through the assignment and New Quiz APIs
For a student to launch an assessment, the cached metadata must be currently verified, published, and within Canvas's configured unlock and lock window. Discovery fails closed — stale or failed metadata is never trusted for student launch.
***
## Configuring Course Policy
**Course settings** provides defaults that apply to every assessment unless explicitly overridden:
* An optional **start password** that protects the inner `.seb` payload — it is a second check before the assessment opens and does not replace certificate encryption, Canvas authentication, or Config Key proof
* The required **effective exit password** that protects native early quit from SEB
* Allowed URL rules under **Advanced website access** for resources that no exam tool covers
* The course **exam-tool catalog** shared across all assessments
Do not reuse the same value for the start password and the exit password. Use **Advanced website access** URL rules only when no approved exam tool can satisfy the resource requirement; the normal course setup flow does not request URL rules.
***
## Adding and Managing Exam Tools
An exam tool is an exact HTTPS launch page paired with a deliberate resource policy. When creating a tool, choose the most restrictive scope that meets the assessment's needs:
| Resource policy | When to use |
| ---------------------------------- | ---------------------------------------------- |
| **This page or file only** | One exact URL or downloadable file |
| **This address and related links** | A bounded site path or subdirectory |
| **This whole website** | Only after explicitly accepting broader access |
Add cross-site resources such as CDN hosts or embedded-content origins only when the tool genuinely requires them. The generated SEB URL filter — not the visible sidebar — is the enforcement boundary that controls what the SEB client can load.
The SEB URL filter is the true enforcement boundary. The sidebar in the SEB interface is a user-interface affordance only and does not determine what the client is permitted to load.
### YouTube Video Tool
Use the dedicated YouTube-video option to share one public video with students. It accepts a watch, share, Shorts, or embed link and converts it into a server-owned embedded player page. It does not permit general YouTube browsing or Google sign-in. The server-owned player page supplies YouTube's required embedding identity while deliberately excluding broader YouTube access.
### Copying a Tool to Other Courses
Instructor-owned course tools can be duplicated to other active courses where the same Canvas user holds the teacher role.
Open the tool you want to duplicate and choose **Duplicate to courses**.
Select one or more eligible target courses from the Canvas-filtered list. The server retrieves the teacher-course list again immediately before writing and snapshots each target's reset generation before those reads. If a course reset completed in the meantime, or if reset-deleted course setup has not yet been recreated by a teacher launch, the copy is rejected for that target.
Review the copy result. Copying appends an equivalent tool to the target catalog without replacing existing tools and is safe to retry.
School-managed presets and quiz-only tools cannot be duplicated using this flow.
***
## Per-Assessment Overrides
Open any assessment's settings to configure it independently from course defaults:
* Inherit course-level start and exit passwords, or set assessment-specific values
* Select a subset of the course exam-tool catalog for this assessment
* Add tools that apply only to this assessment (quiz-only tools never become course defaults)
* Add assessment-specific URL rules under **Advanced website access**
Selecting no course tools for an assessment is a valid, explicit policy. Any protected-policy change — password, tool, URL rule, certificate, or relevant service setting — changes the configuration fingerprint. Students must download a fresh `.seb` file after any such change.
***
## Enabling and Disabling SEB
### Enabling SEB
Enabling SEB on an assessment requires an effective exit password to be set. When you enable SEB, the service:
1. Generates a new Canvas access code
2. Updates the appropriate Classic Quiz or New Quiz in Canvas
3. Persists the SEB policy locally only after Canvas accepts the change
4. Exposes the assessment on the student launch list
Routine instructor responses do not return the access code. Use the explicit, short-lived password reveal only for authorized recovery.
### Disabling SEB
Disabling SEB removes the Safe Online Exam requirement through the corresponding Canvas API and updates local state. If an upstream Canvas error occurs during disable, verify the Canvas assessment directly rather than manually editing both systems in parallel.
### Regenerating the Access Code
You can regenerate the Canvas access code for any SEB-enabled assessment independently of disabling and re-enabling SEB. After regeneration, students must obtain the new code through SEB's Config Key proof flow — the old code is immediately invalid.
***
## Related Pages
See how students connect Canvas, download configurations, and launch protected assessments.
Learn how administrators connect courses, assign school presets, and perform recovery actions.
Review the LTI placement and claim settings that drive instructor course access.
Diagnose quiz-discovery failures, Canvas API errors, and SEB configuration issues.