Student experience

What a student does — connect Canvas once, run a setup check, download a fresh configuration, and take the exam in SEB — and what the tool does for them.

Students interact with the tool as little as possible by design. This page describes the experience so you can support it and write your own student-facing instructions.

The student launches the course-navigation tool and completes a one-time Canvas connection. This authorizes the scoped session handoff the tool uses to place the student into Canvas inside SEB — without copying their normal browser cookies.

Run the setup check (recommended)

The optional setup check generates a separate configuration that tests SEB detection, connectivity, storage, and Config Key proof; with certificate encryption enabled, it also tests certificate decryption. It never releases an assessment access code and does not establish device trust — it just catches a client or profile problem before exam day.

Taking an exam

Download a fresh configuration

From the assessment, the student downloads a .seb file. There is no reusable link — each download is a one-time, 120-second capability tied to the student, the assessment, and current settings. If settings changed, they download again.

Open it in Safe Exam Browser

With the default certificate-encryption mode, the configuration opens only on a device with the managed private identity. In an explicitly approved plaintext compatibility deployment, it can instead be protected by an instructor-set start password. SEB starts and reaches Canvas through the generated session URL.

The code is filled automatically

On the assessment page, the detector proves the running configuration. On success, the access code is filled into the Canvas prompt for the student — they never see or type it. Approved tools become available; disabled tools stay unavailable.

Submit and exit

The student takes and submits the exam. SEB is allowed to quit only after Canvas shows the authoritative completed state; a manual or early quit follows the configured password policy.

What students never do

By design

Students never see the Canvas access code, receive a reusable download link, or handle a private certificate identity. A configured start or early-exit password follows the institution's support process. If a student is being asked for an access-code value, something is wrong — see Troubleshooting → Detector and SEB configuration.

Supporting students

If an encrypted download will not open in SEB, the device may be missing the identity or the configuration may be stale — have the student download a fresh file and confirm the device profile is installed.
If "Connect Canvas" keeps reappearing, the student may be authorizing a different Canvas environment than the launch, or a scope is missing — see OAuth & scopes.
The setup check is the fastest way to confirm a student's device is ready before an exam.