Canva Prod Checklist

Canva Production Checklist

Overview

Complete checklist for deploying Canva Connect API integrations to production, covering OAuth configuration, security, error handling, monitoring, and Canva's integration review process.

Prerequisites

• An approved release owner, exact artifact/configuration version, and tested rollback artifact.
• Mocked tests plus a protected integration environment using synthetic or approved non-production assets and least-privilege credentials.

Instructions

1. Execute the checklist against the exact production candidate and policy configuration.
2. Verify scopes, asset/publication authorization, retention, webhook validation, rate/cost controls, and redacted observability before enabling writes or exports.
3. Keep traffic disabled and roll back if any evidence is missing; do not replace controlled tests with live design data.

Pre-Deployment

OAuth & Security

• Client ID and secret stored in secret manager (not env files)
• Redirect URIs use HTTPS and match production domains
• Only required OAuth scopes requested (least privilege)
• Access tokens stored encrypted at rest
• Refresh token rotation handled (single-use tokens)
• Token revocation implemented for user disconnect
• No client secrets in frontend code

API Integration

• All API calls use api.canva.com/rest/v1/* endpoints
• Rate limits respected with exponential backoff (see canva-rate-limits)
• Export polling implemented with timeout (don't poll forever)
• 429 responses handled with Retry-After header
• 401 responses trigger automatic token refresh
• Error responses parsed and logged (without tokens)
• Blank designs auto-delete warning handled (7-day window)
• Export download URLs consumed within 24-hour window

Webhook Security

• Webhook endpoint uses HTTPS
• JWK signature verification implemented (see canva-webhooks-events)
• Webhook handler returns 200 immediately
• Heavy processing done asynchronously
• Idempotency keys prevent duplicate processing

Data Handling

• No access tokens in log output
• User design metadata treated as sensitive
• Temporary URLs (thumbnails, exports) not cached beyond expiry
• Thumbnail URLs expire in 15 minutes — refresh as needed
• Edit/view URLs expire in 30 days — regenerate via API

Production Readiness Verification

#!/bin/bash
# canva-prod-verify.sh

echo "=== Canva Production Readiness ==="

# 1. Verify API connectivity from production
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
  -H "Authorization: Bearer $CANVA_ACCESS_TOKEN" \
  "https://api.canva.com/rest/v1/users/me")
echo "[$([ $HTTP_CODE = 200 ] && echo 'PASS' || echo 'FAIL')] API connectivity: HTTP $HTTP_CODE"

# 2. Test design creation
DESIGN=$(curl -s -X POST "https://api.canva.com/rest/v1/designs" \
  -H "Authorization: Bearer $CANVA_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"design_type":{"type":"custom","width":100,"height":100},"title":"Prod Test"}')
DESIGN_ID=$(echo "$DESIGN" | python3 -c "import sys,json; print(json.load(sys.stdin)['design']['id'])" 2>/dev/null)
echo "[$([ -n "$DESIGN_ID" ] && echo 'PASS' || echo 'FAIL')] Design creation: $DESIGN_ID"

# 3. Test export
if [ -n "$DESIGN_ID" ]; then
  EXPORT=$(curl -s -X POST "https://api.canva.com/rest/v1/exports" \
    -H "Authorization: Bearer $CANVA_ACCESS_TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"design_id\":\"$DESIGN_ID\",\"format\":{\"type\":\"png\"}}")
  EXPORT_ID=$(echo "$EXPORT" | python3 -c "import sys,json; print(json.load(sys.stdin)['job']['id'])" 2>/dev/null)
  echo "[$([ -n "$EXPORT_ID" ] && echo 'PASS' || echo 'FAIL')] Export job: $EXPORT_ID"
fi

echo ""
echo "=== Done ==="

Canva Integration Review

For public integrations (available to all Canva users), you must pass Canva's review:

1. Submit your integration for review in the Canva developer portal
2. Canva reviews security, OAuth implementation, and UX
3. Preview features (e.g., webhooks) are not allowed in public integrations
4. Fix any issues and resubmit

Private integrations (your organization only) do not require review.

Health Check Endpoint

app.get('/health', async (req, res) => {
  const start = Date.now();
  let canvaStatus = 'unknown';

  try {
    const me = await fetch('https://api.canva.com/rest/v1/users/me', {
      headers: { 'Authorization': `Bearer ${getServiceToken()}` },
      signal: AbortSignal.timeout(5000),
    });
    canvaStatus = me.ok ? 'healthy' : `error:${me.status}`;
  } catch {
    canvaStatus = 'unreachable';
  }

  res.json({
    status: canvaStatus === 'healthy' ? 'healthy' : 'degraded',
    services: { canva: { status: canvaStatus, latencyMs: Date.now() - start } },
    timestamp: new Date().toISOString(),
  });
});

Monitoring Alerts

Output

The readiness run produces a redacted go/no-go receipt with artifact/config versions, approved scope, test mode, health result, and rollback version. It excludes credentials, design content, asset URLs, and user data.

Examples

Run mocked tests and one approved synthetic-asset integration check before release, then attach the receipt. If authorization, retention, rate-limit, or reconciliation evidence fails, leave the release disabled and restore the prior artifact.

Error Handling

Resources

• Canva Connect Quickstart
• Creating Integrations
• Canva Changelog

Next Steps

For version upgrades, see canva-upgrade-migration.