# Glossary

> Definitions for Safe Exam Browser, Canvas LTI, Config Keys, Browser Exam Keys, deployment IDs, AAC, pkhs wrapping, and other operator terms.

[Canonical HTML page](https://safeonlineexam.com/docs/reference/glossary)

## AAC [#aac]

**Automatic Assessment Configuration** — a macOS mechanism the generated
configuration requires (via `enableMacOSAAC` and `lockdownModePolicy`) to lock the
device into the assessment. It provides strong lockdown but can block some
third-party assistive technology, so accommodations that need such tools should be
a separately approved arrangement rather than a weakened shared configuration. See
[Device deployment](/docs/operate/devices).

## Access code [#access-code]

The Canvas quiz access code the tool creates, writes to the assessment, and rotates
on the instructor's behalf. It is never shown in routine UI or API responses and is
released to a student only after Config Key proof — filled into Canvas
automatically, never seen by the student.

## Browser Exam Key (BEK) [#browser-exam-key-bek]

A key derived into the SEB configuration that a server can use to recognize a
request coming from a specific SEB configuration. The tool derives it as part of
the generated assessment configuration.

## Config Key [#config-key]

A hash SEB computes over its effective configuration. The tool uses **Config Key
proof** — comparing the running configuration's Config Key against current
server-side settings — to decide whether to release the access code. This is why
changing a protected setting invalidates old downloads.
[Reference: safeexambrowser.org](https://safeexambrowser.org/developer/seb-config-key.html).

## Deployment ID [#deployment-id]

The identifier Canvas assigns when the external app is installed. By default the
service only accepts launches whose signed deployment ID is in
`LTI_DEPLOYMENT_ID`. See
[Install the app](/docs/canvas/install-app#choose-the-deployment-id-policy).

## Detector [#detector]

The browser script, loaded through your Canvas theme, that runs on quiz pages. It
launches the protected flow, requests Config Key proof, fills the access code,
surfaces approved tools, and detects Canvas-confirmed completion. See
[Detector script](/docs/canvas/detector-script).

## JSON configuration URL [#json-configuration-url]

The Canvas Developer Key workflow where Canvas reads the tool configuration from
`${TOOL_URL}/lti/config` instead of requiring manually copied fields. It is not the
separate OpenID Dynamic Registration protocol.

## Hardened runtime [#hardened-runtime]

A deployment where strict validation is enforced — production, or **any** Cloud Run
service. It requires real database, Canvas, LTI, OAuth, secret, and URL values;
it also requires a valid X.509 certificate whenever certificate encryption is
enabled. It refuses unsafe options such as in-memory storage or debug mode.

## JWKS [#jwks]

**JSON Web Key Set** — the set of public keys used to verify signed tokens. The
tool publishes its own at `/.well-known/jwks.json`; Canvas publishes the platform
JWKS the tool verifies launches against (`LTI_KEY_SET_URL`).

## LTI 1.3 [#lti-13]

The **Learning Tools Interoperability** standard (version 1.3) Canvas uses to
launch external tools with signed identity claims.
[Specification](https://www.imsglobal.org/spec/lti/v1p3).

## OIDC [#oidc]

**OpenID Connect** — the login-initiation step of an LTI 1.3 launch, handled at
`/lti/login` before Canvas posts the signed launch to `/lti/launch`.

## pkhs [#pkhs]

SEB's **public-key-hash** encrypted-file format. When a public certificate is
configured, the outer `.seb` file is wrapped in `pkhs` format so it opens only on a
device holding the matching private identity.

## Proof / access proof [#proof--access-proof]

The one-time token the service issues after Config Key proof succeeds. It is
redeemed once (valid two minutes) to return the access code, approved tools, and an
exit grant. See [How it works](/docs/how-it-works#the-release-gate-four-checks).

## SEB [#seb]

**Safe Exam Browser** — the lockdown client that runs the exam. This tool requires
and verifies it. [safeexambrowser.org](https://safeexambrowser.org/).

## Setup check [#setup-check]

A separate configuration and flow (`/seb/check`) that tests certificate
decryption, SEB detection, connectivity, storage, and Config Key proof without
releasing any access code. Use it to validate a device before an exam. See
[Student experience](/docs/operate/student).

## `.seb` configuration [#seb-configuration]

The configuration file a student downloads and opens in Safe Exam Browser. With
the default certificate-encryption mode it is encrypted to the managed device
identity; in the explicit compatibility mode it is plaintext unless an instructor
sets a start password. Either way, each download is a one-time, 120-second
capability bound to the student, assessment, and current settings.

## TOOL\_URL [#tool_url]

The public HTTPS origin of a deployment. It is baked into the LTI registration,
OAuth callback, JWKS URL, and detector URL — decide it before creating Canvas keys.

## Two-pass bootstrap [#two-pass-bootstrap]

The first-install pattern: deploy once with placeholder LTI IDs to get a stable URL
and a working `/lti/config`, register in Canvas, then redeploy with the real client
and deployment IDs. See [Setup overview](/docs/setup-overview).