# Student experience

> What a student does — connect Canvas once, run a setup check, download a fresh configuration, and take the exam in SEB — and what the tool does for them.

[Canonical HTML page](https://safeonlineexam.com/docs/operate/student)

Students interact with the tool as little as possible by design. This page
describes the experience so you can support it and write your own student-facing
instructions.

## The one-time setup [#the-one-time-setup]

<Steps>
  <Step>
    ### Connect Canvas [#connect-canvas]

    The student launches the course-navigation tool and completes a one-time Canvas
    connection. This authorizes the scoped session handoff the tool uses to place the
    student into Canvas inside SEB — without copying their normal browser cookies.
  </Step>

  <Step>
    ### Run the setup check (recommended) [#run-the-setup-check-recommended]

    The optional setup check generates a separate configuration that tests SEB
    detection, connectivity, storage, and Config Key proof; with certificate
    encryption enabled, it also tests certificate decryption. It never releases an
    assessment access code and does not establish device trust — it just catches a
    client or profile problem before exam day.
  </Step>
</Steps>

## Taking an exam [#taking-an-exam]

<Steps>
  <Step>
    ### Download a fresh configuration [#download-a-fresh-configuration]

    From the assessment, the student downloads a `.seb` file. There is no reusable
    link — each download is a one-time, 120-second capability tied to the student, the
    assessment, and current settings. If settings changed, they download again.
  </Step>

  <Step>
    ### Open it in Safe Exam Browser [#open-it-in-safe-exam-browser]

    With the default certificate-encryption mode, the configuration opens only on a
    device with the managed private identity. In an explicitly approved plaintext
    compatibility deployment, it can instead be protected by an instructor-set start
    password. SEB starts and reaches Canvas through the generated session URL.
  </Step>

  <Step>
    ### The code is filled automatically [#the-code-is-filled-automatically]

    On the assessment page, the detector proves the running configuration. On success,
    the access code is filled into the Canvas prompt **for the student** — they never
    see or type it. Approved tools become available; disabled tools stay unavailable.
  </Step>

  <Step>
    ### Submit and exit [#submit-and-exit]

    The student takes and submits the exam. SEB is allowed to quit only after Canvas
    shows the authoritative completed state; a manual or early quit follows the
    configured password policy.
  </Step>
</Steps>

## What students never do [#what-students-never-do]

<Callout title="By design">
  Students never see the Canvas access code, receive a reusable download link, or
  handle a private certificate identity. A configured start or early-exit password
  follows the institution's support process. If a student is being asked for an
  access-code value, something is wrong — see
  [Troubleshooting → Detector](/docs/troubleshooting/detector) and
  [SEB configuration](/docs/troubleshooting/seb-configuration).
</Callout>

## Supporting students [#supporting-students]

* If an encrypted download will not open in SEB, the device may be missing the
  identity or the configuration may be stale — have the student download a fresh
  file and confirm the device profile is installed.
* If "Connect Canvas" keeps reappearing, the student may be authorizing a different
  Canvas environment than the launch, or a scope is missing — see
  [OAuth & scopes](/docs/troubleshooting/oauth-scopes).
* The setup check is the fastest way to confirm a student's device is ready before
  an exam.