Student experience

What a student does — connect Canvas once, run a setup check, download a fresh configuration, and take the exam in SEB — and what the tool does for them.

Students interact with the tool as little as possible by design. This page describes the experience so you can support it and write your own student-facing instructions.

The student launches the course-navigation tool when that placement is enabled, or starts from a protected assessment, and completes a one-time Canvas connection. This authorizes the scoped session handoff the tool uses to place the student into Canvas inside SEB — without copying their normal browser cookies.

Run the setup check (recommended)

The optional setup check generates a separate configuration that tests SEB detection, connectivity, storage, and Config Key proof; with certificate encryption enabled, it also tests certificate decryption. It never releases an assessment access code and does not establish device trust — it just catches a client or profile problem before exam day.

Taking an exam

Download a fresh configuration

From the assessment, the student downloads a .seb file only after Canvas confirms that the exact assessment is currently available to that student. There is no reusable link — each download is a one-time, 120-second capability tied to the student, the assessment, and current settings. The verified admission lasts five minutes for the configuration and browser-handoff chain. If settings changed, they download again.

Open it in Safe Exam Browser

With the default certificate-encryption mode, the configuration opens only on a device with the managed private identity. In an explicitly approved plaintext compatibility deployment, it can instead be protected by an instructor-set start password. SEB starts and reaches Canvas through the generated session URL.

The code is filled automatically

On the assessment page, the detector proves the running configuration. On success, the access code is filled into the Canvas prompt for the student — they never see or type it. Approved tools become available; disabled tools stay unavailable.

Submit and exit

The student takes and submits the exam. SEB is allowed to quit only after Canvas shows the authoritative completed state; a manual or early quit follows the configured password policy. The handoff returns to the verified Canvas course, including after a used, reused, or expired handoff, rather than reviving an old browser prompt.

What students never do

By design

Students never see the Canvas access code, receive a reusable download link, or handle a private certificate identity. A configured start or early-exit password follows the institution's support process. If a student is being asked for an access-code value, something is wrong — see Troubleshooting → Detector and SEB configuration.

Supporting students

If an encrypted download will not open in SEB, the device may be missing the identity or the configuration may be stale — have the student download a fresh file and confirm the device profile is installed.
If "Connect Canvas" keeps reappearing, the student may be authorizing a different Canvas environment than the launch, or a scope is missing — see OAuth & scopes.
The setup check is the fastest way to confirm a student's device is ready before an exam.
If Canvas says the assessment is unavailable, do not tell the student to reuse a prior configuration link. Confirm Canvas publication, dates, and differentiated access, then have them retry from Canvas.