# FAQ

> Answers for administrators and operators about Canvas environments, deployment, OAuth scopes, SEB configuration, access codes, and rollback.

[Canonical HTML page](https://safeonlineexam.com/docs/reference/faq)

<Accordions>
  <Accordion title="Can one deployment serve two Canvas environments?">
    No. A deployment is bound to one Canvas origin and one LTI deployment boundary.
    Run a separate deployment — with its own URL, database, secrets, LTI registration,
    and OAuth credentials — for each independent Canvas (for example, test and
    production). This isolation is what keeps one environment from reading another's
    tokens or settings. See [How it works](/docs/how-it-works#one-deployment-per-canvas).
  </Accordion>

  <Accordion title="Do I have to use Google Cloud?">
    No. Google Cloud Run + Cloud SQL is the recommended managed path, but the
    versioned Compose bundle is a maintained option for a Linux host with Docker and
    PostgreSQL 17. The application runtime is provider-neutral. New public installs
    use release bundles; Cloud Build remains a source-based path for the repository's
    existing maintained Cloud Run environments. See [Deployment](/docs/deploy).
  </Accordion>

  <Accordion title="Why do students have to re-download the .seb file so often?">
    Because a configuration is cryptographically tied to a set of settings via the
    Config Key. When a protected setting changes — allowed tools, passwords, URL
    policy — the old configuration no longer proves against the new settings, so a
    fresh download is required. This guarantees students always run current policy.
    Communicate setting changes before an exam window.
  </Accordion>

  <Accordion title="A scope I need is not shown in the Canvas Developer Keys UI. What now?">
    Some Canvas environments hide certain endpoint scopes (commonly the
    `session_token` scope). Add the exact endpoint scope string through the instance's
    supported Developer Keys administration/API path, deploy, and have affected admins
    select **Reconnect Canvas** once. Never substitute a similarly named login
    permission. See [OAuth & scopes](/docs/troubleshooting/oauth-scopes).
  </Accordion>

  <Accordion title="My Canvas is self-hosted and the tool tries to reach sso.canvaslms.com. Why?">
    The deployment still holds Canvas cloud defaults. Override `LTI_AUTH_URL` and
    `LTI_KEY_SET_URL` with your self-hosted endpoints, and confirm the exact issuer
    (`LTI_ISSUER`) — a self-hosted Canvas can still use the standard issuer, so do not
    infer it from the hostname. See [Self-hosted Canvas](/docs/canvas/self-hosted-canvas).
  </Accordion>

  <Accordion title="Can I disable encryption or Config Key proof to get a rollout working?">
    Config Key proof is still required. Certificate encryption is enabled by default,
    but an instance may explicitly use plaintext compatibility mode when it cannot
    distribute a managed private identity. That preserves proof, grants, URL filtering,
    and lockdown policy, but removes the device-specific protection on the downloaded
    file. Treat it as a documented institutional risk decision, never as a response to
    a certificate incident. See [Certificate management](/docs/deploy/certificates).
  </Accordion>

  <Accordion title="Where does the private encryption key live?">
    Only on approved exam devices, installed through your device-management platform,
    non-extractable and scoped to the SEB application. The service holds only the
    public certificate. Never put the private identity in the server runtime or hand it
    to a student. See [Certificate management](/docs/deploy/certificates).
  </Accordion>

  <Accordion title="Does the tool store or expose the Canvas access code?">
    The code is created, written to Canvas, and rotated by the tool, and is redacted in
    routine UI and API responses. It is released only to a verified SEB session after
    Config Key proof, and the detector fills it automatically — the student never sees
    it. Instructors and administrators can perform a controlled, no-store, briefly
    visible reveal for recovery.
  </Accordion>

  <Accordion title="What database do I need, and can I use a managed one?">
    PostgreSQL 17 or newer. Any managed or self-run PostgreSQL works — the app uses
    ordinary protocol settings. Cloud Run uses Cloud SQL over an authenticated socket;
    an external managed database should normally use `verify-full` TLS. See
    [Configuration → PostgreSQL](/docs/deploy/configuration#postgresql).
  </Accordion>

  <Accordion title="How do I roll back a bad release?">
    Confirm the previous application revision is compatible with the **current** schema
    first — traffic rollback does not roll back the database. Then shift traffic (Cloud
    Run) or restore the prior image (Docker). Schema recovery is a separate, forward
    decision. See [Operations → Rollback](/docs/operate/operations#rollback) and
    [Incident response](/docs/operate/incident-response).
  </Accordion>

  <Accordion title="Is this affiliated with Instructure or the SEB project?">
    No. Safe Online Exam is an independent integration that connects Canvas
    and Safe Exam Browser; it is not affiliated with Instructure or the Safe Exam
    Browser project.
  </Accordion>
</Accordions>

Still stuck? Start at the [troubleshooting symptom index](/docs/troubleshooting),
or review [How it works](/docs/how-it-works) to confirm your mental model.