Protected assessment workflows, built for Canvas.

A symptom index — find what you are seeing, jump to the check that resolves it. Organized by where the symptom appears.

Troubleshooting is organized by where you see the problem: in the Canvas launch, during authorization, in the detector on quiz pages, in SEB with the configuration, or in the deployment itself. Find your symptom below and follow the link.

First, isolate the layer

Before diving in, a 30-second triage narrows the search dramatically:

Is the service healthy?

curl -fsS "${TOOL_URL}/health"
curl -fsS "${TOOL_URL}/ready"

/health fails → the process is down. /ready fails → PostgreSQL is unreachable or migrations are not applied. Both are deployment problems, not Canvas ones.

Do the public endpoints respond?

curl -fsS "${TOOL_URL}/lti/config"
curl -fsS "${TOOL_URL}/.well-known/jwks.json"
curl -fsS "${TOOL_URL}/js/canvas-seb-detector.js" | head

If these fail, fix the deployment before touching Canvas.

Where does it break for a user?

Launch → Canvas launch. "Connect Canvas" loops or scope errors → OAuth & scopes. Quiz page / detector → Detector. Inside SEB / the .seb file → SEB configuration.

Symptom index

Symptom	Section
`sso.canvaslms.com refused to connect`	Canvas launch
`Canvas Signing-Key Error`	Canvas launch
`Invalid LTI Launch`	Canvas launch
`LTI Deployment Configuration Required`	Canvas launch
Administrator dashboard missing or denied	Canvas launch
A launch works in one environment but not another	Canvas launch
A scope does not appear in the Developer Keys UI	OAuth & scopes
Instructor is asked to authorize repeatedly	OAuth & scopes
Student cannot connect Canvas / download fails	OAuth & scopes
Detector never loads on quiz pages	Detector
HTTP `422` on the theme JavaScript file	Detector
Access code is not filled in SEB	Detector
Approved tools missing, or exit will not trigger	Detector
SEB cannot open a downloaded configuration	SEB configuration
A device fails after certificate rotation	SEB configuration
Config Key proof fails after a settings change	SEB configuration
Service fails to start / `/ready` never passes	Deployment
Migration or cleanup job failures	Deployment

A note on error messages

The tool shows deliberately specific error states — sso.canvaslms.com refused to connect, Canvas Signing-Key Error, Connect Canvas, Invalid LTI Launch. Read the exact text: it maps directly to a cause and a fix, which is why the launch recovery table in Self-hosted Canvas and the sections here are keyed on it.

Troubleshooting