Setup overview
The entire installation on one page — the order of operations, why each step precedes the next, and a checklist you can track against.
This is the whole journey in order. Each deep-dive page has the exact commands; this page is the map, so you always know where you are and what has to be true before the next step.
The order, and why
The dependency that shapes everything
Canvas registrations bind to your final TOOL_URL, and the LTI registration is
served by the running service at ${TOOL_URL}/lti/config. So you deploy first
(with placeholder LTI IDs), then register in Canvas, then redeploy with the real
IDs. Both deploy guides call this the two-pass bootstrap. Trying to create
Canvas keys before the service has a stable URL is the main way this gets tangled.
Deploy the application (pass 1)
Provision the database and secrets, reserve the stable HTTPS URL, and deploy the
service with bootstrap-pending LTI client and deployment IDs. Confirm
/health, /ready, /lti/config, and JWKS respond.
→ Google Cloud · Docker · Configuration
Create the SEB encryption identity
Generate the certificate/identity pair. The public certificate goes to the service; the private identity goes only to your device vault. This can be done alongside pass 1.
Create Canvas credentials
Create the API OAuth Developer Key (with the exact scopes) and the LTI 1.3
Developer Key (from ${TOOL_URL}/lti/config). Record the client IDs.
→ API OAuth key · LTI key
Install the app and record the deployment ID
Install the external app at the intended account scope by client ID. Canvas assigns a deployment ID — record it.
Redeploy with real IDs (pass 2)
Put the real LTI_CLIENT_ID and LTI_DEPLOYMENT_ID into your secret store and
deploy a new revision. The service now accepts real launches.
Load the detector script
Add the small theme loader so the detector runs on quiz pages. Self-hosted Canvas may need the hosted-loader workaround.
Deploy the certificate to devices
Install the private identity onto exam devices via your MDM, non-extractable and SEB-scoped. Validate on a test device with the setup check.
Verify end to end
Run the administrator, instructor, student, and in-SEB acceptance sequence before any real exam.
Schedule operations
Turn on scheduled cleanup, backups, and monitoring; document your rotation and incident procedures.
Checklist
Copy this into your rollout ticket.
PLAN
[ ] Final HTTPS TOOL_URL decided (and custom domain mapped, if any)
[ ] Canvas cloud vs self-hosted determined; issuer/endpoints confirmed
[ ] Deployment-ID policy decided
[ ] SEB clients + MDM ready for device identity install
DEPLOY (pass 1)
[ ] Database provisioned (PostgreSQL 17+)
[ ] Secrets created (LTI key, session/state secrets, DB password)
[ ] Stable URL reserved; service reachable without auth challenge
[ ] Service deployed with bootstrap-pending LTI IDs
[ ] /health, /ready, /lti/config, /.well-known/jwks.json all respond
CERTIFICATE
[ ] Identity generated; public cert in the service secret
[ ] Private .p12 + passphrase moved to device vault; workstation copies removed
CANVAS
[ ] API OAuth key created with full application + admin scopes
[ ] LTI 1.3 key created from /lti/config and enabled
[ ] App installed; deployment ID recorded
DEPLOY (pass 2)
[ ] Real LTI_CLIENT_ID and LTI_DEPLOYMENT_ID deployed
[ ] Detector theme loader installed and loading on quiz pages
ROLL OUT
[ ] Certificate profile installed on test device; setup check passes
[ ] Admin / instructor / student / in-SEB acceptance sequence passed
OPERATE
[ ] Cleanup scheduled (daily)
[ ] Backups running + one restore drill completed
[ ] Monitoring/alerts configured
[ ] Rotation + incident procedures documentedStart with Deploy the application.