Glossary

AAC

Automatic Assessment Configuration — a macOS mechanism the generated configuration requires (via enableMacOSAAC and lockdownModePolicy) to lock the device into the assessment. It provides strong lockdown but can block some third-party assistive technology, so accommodations that need such tools should be a separately approved arrangement rather than a weakened shared configuration. See Device deployment.

Access code

The Canvas quiz access code the tool creates, writes to the assessment, and rotates on the instructor's behalf. It is never shown in routine UI or API responses and is released to a student only after Config Key proof — filled into Canvas automatically, never seen by the student.

Browser Exam Key (BEK)

A key derived into the SEB configuration that a server can use to recognize a request coming from a specific SEB configuration. The tool derives it as part of the generated assessment configuration.

Config Key

A hash SEB computes over its effective configuration. The tool uses Config Key proof — comparing the running configuration's Config Key against current server-side settings — to decide whether to release the access code. This is why changing a protected setting invalidates old downloads. Reference: safeexambrowser.org.

Deployment ID

The identifier Canvas assigns when the external app is installed. By default the service only accepts launches whose signed deployment ID is in LTI_DEPLOYMENT_ID. See Install the app.

Detector

The browser script, loaded through your Canvas theme, that runs on quiz pages. It launches the protected flow, requests Config Key proof, fills the access code, surfaces approved tools, and detects Canvas-confirmed completion. See Detector script.

Dynamic registration

The LTI 1.3 flow where Canvas reads the tool's registration document from ${TOOL_URL}/lti/config instead of you copying fields by hand. Preferred, because the running service stays the source of truth.

Hardened runtime

A deployment where strict validation is enforced — production, or any Cloud Run service. It requires real database, Canvas, LTI, OAuth, secret, URL, and certificate values, mandates certificate encryption, and refuses unsafe options like in-memory storage or debug mode.

JWKS

JSON Web Key Set — the set of public keys used to verify signed tokens. The tool publishes its own at /.well-known/jwks.json; Canvas publishes the platform JWKS the tool verifies launches against (LTI_KEY_SET_URL).

LTI 1.3

The Learning Tools Interoperability standard (version 1.3) Canvas uses to launch external tools with signed identity claims. Specification.

OIDC

OpenID Connect — the login-initiation step of an LTI 1.3 launch, handled at /lti/login before Canvas posts the signed launch to /lti/launch.

pkhs

SEB's public-key-hash encrypted-file format. When a public certificate is configured, the outer .seb file is wrapped in pkhs format so it opens only on a device holding the matching private identity.

Proof / access proof

The one-time token the service issues after Config Key proof succeeds. It is redeemed once (valid two minutes) to return the access code, approved tools, and an exit grant. See How it works.

SEB

Safe Exam Browser — the lockdown client that runs the exam. This tool requires and verifies it. safeexambrowser.org.

Setup check

A separate configuration and flow (/seb/check) that tests certificate decryption, SEB detection, connectivity, storage, and Config Key proof without releasing any access code. Use it to validate a device before an exam. See Student experience.

.seb configuration

The certificate-encrypted configuration file a student downloads and opens in Safe Exam Browser. Each download is a one-time, 120-second capability bound to the student, assessment, and current settings.

TOOL_URL

The public HTTPS origin of a deployment. It is baked into the LTI registration, OAuth callback, JWKS URL, and detector URL — decide it before creating Canvas keys.

Two-pass bootstrap

The first-install pattern: deploy once with placeholder LTI IDs to get a stable URL and a working /lti/config, register in Canvas, then redeploy with the real client and deployment IDs. See Setup overview.