Canva Advanced Failure Isolation

Overview

Separate application, authorization, provider-contract, asynchronous-job, and network evidence before choosing a recovery action. Preserve the original operation identity and collect only redacted facts.

Prerequisites

• Incident identifier, first-observed time, and affected operation
• Current integration configuration and pinned OpenAPI version
• Approved synthetic reproduction user and evidence destination

Instructions

Step 1: Freeze the failing operation

Record method, endpoint pattern, environment, opaque operation or job identifier, expected terminal state, and last known good release. Do not copy raw payloads or URLs.

Step 2: Inspect local evidence

Use Read and Grep to compare sanitized logs, deployment/config revisions, token metadata timestamps, scope policy, and the pinned response schema.

Step 3: Classify the boundary

Distinguish transport failure, HTTP/provider error, OAuth expiry or revocation, missing explicit scope, unavailable capability, preview drift, and an asynchronous job still in progress.

Step 4: Reproduce read-only

Use a dedicated test user for the smallest non-mutating check. Never refresh a token merely to diagnose unless the credential owner authorizes rotation and atomic storage is available.

Step 5: Reconcile before retry

Query the existing job or resource where the contract permits. Do not recreate a design, export, upload, or autofill job until duplicate impact and idempotency are resolved.

Step 6: Escalate with a safe receipt

Provide Canva support only the integration ID, UTC window, endpoint pattern, redacted error code, opaque request/job reference, contract version, and bounded reproduction result.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A production export intermittently remains in progress. The operator correlates the same job ID with deployment and provider evidence, pauses new submissions, and escalates without attaching the design or token.

Error Handling

Canva Architecture Decision

Overview

Select the smallest topology that preserves backend OAuth, per-user token isolation, asynchronous job reconciliation, and policy-controlled data handling. Treat scale thresholds as measured local evidence, not Canva product limits.

Prerequisites

• Expected operations, traffic shape, tenants, and recovery objectives
• Data classification, retention policy, and secret backend
• Current scopes, capabilities, preview dependencies, and deployment constraints

Instructions

Step 1: Map trust boundaries

Identify browser, backend, token store, job ledger, worker, data store, and Canva API boundaries. Mark every place customer content or credentials could cross.

Step 2: Choose the base shape

Use a backend monolith for one bounded service, a service plus worker when asynchronous jobs must outlive requests, or isolated services only when ownership and failure domains justify them.

Step 3: Design token rotation

Serialize refresh per Canva user, atomically replace the single-use refresh token, and separate access-token and refresh-token storage.

Step 4: Design job reconciliation

Persist opaque job identity before dispatch, poll with bounded backoff, and reconcile terminal state before repeating a mutating operation.

Step 5: Design policy enforcement

Resolve tenant, resource, explicit scope, capability, preview status, and data policy before dispatch rather than inside a generic HTTP client.

Step 6: Record the decision

Use Write or Edit to capture selected shape, rejected alternatives, assumptions, failure modes, rollback, and validation evidence.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A service exports designs asynchronously for multiple tenants. A backend owns OAuth and policy, a durable ledger owns job identity, and workers are partitioned by tenant without embedding user IDs in metrics.

Error Handling

Canva Fork-Safe CI Contract Lane

Overview

Keep pull-request validation offline and deterministic. Reserve one minimal live read for trusted commits after environment protection, without rotating production tokens inside CI.

Prerequisites

• Existing test framework and repository-defined command
• Pinned Canva OpenAPI snapshot or validated fixtures
• Protected environment with dedicated test integration and cleanup owner

Instructions

Step 1: Inventory workflow trust

Use Read and Grep to map pull-request events, fork execution, secret references, generated clients, artifact uploads, and any code path that creates Canva resources.

Step 2: Define offline contracts

Use Write or Edit to test request construction, error parsing, explicit-scope checks, async job states, redaction, and unknown response fields against fixtures.

Step 3: Pin provider inputs

Version the OpenAPI snapshot or its checksum and make drift visible. Do not silently regenerate clients during an unrelated test run.

Step 4: Add a protected live read

Use an approved test user to call a non-mutating identity or metadata endpoint. Assert authorization and response shape, not volatile content.

Step 5: Close secret boundaries

Do not use privileged pull-request events to run untrusted code. Keep client secrets and refresh tokens outside job logs, artifacts, caches, and fork contexts.

Step 6: Emit exact-head evidence

Record commit, commands, fixture version, live endpoint pattern, protected environment, redaction result, and cleanup status.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

Every fork runs mocked OAuth and response fixtures. A protected main-branch job performs one user-identity read and fails closed when its expected credential is absent.

Error Handling

Canva Error Classification

Overview

Treat HTTP status alone as insufficient. Use the current endpoint reference and redacted provider error code to separate caller defects, authorization failures, throttling, preview drift, and provider incidents.

Prerequisites

• HTTP status, provider error code, endpoint pattern, and UTC window
• Opaque request, resource, or job reference without payload content
• Pinned OpenAPI or endpoint documentation version

Instructions

Step 1: Capture a minimal envelope

Record method, endpoint pattern, status, provider code, terminal job state, retry metadata if actually present, and deployment version. Exclude tokens, bodies, signed URLs, and customer identifiers.

Step 2: Handle authentication failures

For an invalid or expired access token, serialize the authorized refresh flow and atomically store the replacement refresh token. Reauthorize after revocation or unrecoverable refresh failure.

Step 3: Handle authorization failures

Compare the operation with explicit granted scopes, resource ownership, capabilities, tenant policy, and preview availability. Never assume a write scope grants its read counterpart.

Step 4: Handle throttling

Pause only the affected endpoint/user queue. Use documented endpoint metadata and response instructions; otherwise apply bounded exponential backoff with jitter rather than a guessed fixed delay.

Step 5: Handle async failures

Poll the existing job to a documented terminal state. Correct validation or entitlement errors before any new submission.

Step 6: Escalate provider failures

Correlate repeated server errors with Canva status/changelog and provide a redacted support receipt after bounded retry is exhausted.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

An autofill returns HTTP 403. The operator checks explicit scopes, current capability and Enterprise availability, template ownership, preview status, and the provider error before deciding whether reauthorization is relevant.

Error Handling

Canva Design and Export Workflow

Overview

Keep design creation, user editing, export submission, job reconciliation, and result delivery as separate recorded operations. Query current supported export formats instead of hard-coding a universal list.

Prerequisites

• Approved design purpose, owner, input rights, and destination
• Explicit design scopes and resource authorization
• Pinned endpoint contract and result-data retention decision

Instructions

Step 1: Authorize the request

Resolve tenant, user, design purpose, required explicit scopes, content rights, and whether a new design is permitted.

Step 2: Create once

Persist an application operation key before submitting the design request. Store only the returned opaque design reference and approved URLs under policy.

Step 3: Confirm user handoff

Present the correct view or edit surface only to the authorized user. Do not treat creation as evidence that downstream export is allowed.

Step 4: Discover formats

Query the design export-formats endpoint when available and validate the requested format/options against that response and current OpenAPI.

Step 5: Submit and poll export

Persist the export job ID, poll the existing job with bounded exponential backoff, and stop on success, failed, or the local timeout budget.

Step 6: Deliver and expire

Validate content type and destination, keep result URLs out of logs, honor response/provider expiry evidence, and record cleanup or retention.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A user creates an approved presentation, edits it in Canva, then requests PDF export. The service checks available formats, submits one job, reconciles its ID, and delivers the result through an access-controlled application route.

Error Handling

Canva Asset, Autofill, and Folder Workflow

Overview

Treat asset upload, dataset discovery, autofill, and folder mutation as separate authorization domains. Re-read schemas and reconcile asynchronous jobs rather than assuming old fields or completion.

Prerequisites

• Authorized owner, tenant, operation, and destination
• Explicit asset, design, brand-template, or folder scopes
• Approved file rights, data classification, and cleanup policy

Instructions

Step 1: Choose one operation

Identify upload, asset metadata change, template dataset read, autofill, or folder mutation. Do not bundle unrelated writes into one approval.

Step 2: Validate rights and input

Confirm resource ownership, file type/size against the current endpoint, malware policy, template availability, and every requested explicit scope.

Step 3: Submit upload safely

For binary or URL upload, record the operation and job ID, avoid logging source URLs or content, and poll the corresponding existing job.

Step 4: Refresh the dataset

Read the current template or design dataset immediately before autofill. Reject unknown required fields and disclose that nonexistent field names may be skipped.

Step 5: Run autofill deliberately

Confirm current entitlement and preview status, validate each data value, submit once, and reconcile the job before exposing the resulting design.

Step 6: Apply folder mutation

Validate source/destination authorization and expected current state, make one bounded change, then read back metadata and record rollback.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

An approved campaign asset is uploaded, a current brand-template dataset is fetched, authorized fields are autofilled, and the resulting design is moved only after each job and ownership check succeeds.

Error Handling

Canva Usage and Entitlement Control

Overview

Optimize application behavior, not an imagined universal Canva bill. Use current endpoint metadata, capability/trial responses, and local operation receipts to find duplicate calls, polling waste, and avoidable retries.

Prerequisites

• Measurement window and application operation ledger
• Current tenant entitlement, capability, and contract evidence
• Latency, freshness, retry, and data-retention budgets

Instructions

Step 1: Build the baseline

Use Read and Grep to count logical operations, provider requests, retries, polling reads, cache hits, failures, and premium-feature responses by endpoint pattern.

Step 2: Separate request classes

Distinguish user reads, metadata reads, mutating submissions, and job-status polling. Never combine them into one cost number.

Step 3: Remove duplicates

Persist operation identity before writes, coalesce concurrent reads where safe, and reconcile existing jobs before resubmission.

Step 4: Tune polling

Apply bounded exponential backoff to existing asynchronous jobs and stop at the application timeout without creating replacements.

Step 5: Tune caches safely

Cache only policy-approved metadata with explicit freshness and authorization invalidation. Never cache tokens or signed result URLs as durable content.

Step 6: Gate the change

Use Write or Edit to record baseline, selected control, expected impact, experiment window, rollback threshold, and measured result.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A review finds repeated export submissions caused by request timeouts. The service persists job identity before dispatch and resumes polling, reducing duplicate work without claiming a dollar savings percentage.

Error Handling

Canva Data Lifecycle Control

Overview

Create an application-specific lifecycle map for every Canva data class. Minimize stored content, keep credentials segregated, and make deletion/revocation evidence reproducible without logging protected values.

Prerequisites

• Current data-flow and storage inventory
• Approved classification, retention, deletion, and legal-hold policy
• Tenant and resource ownership model plus incident contacts

Instructions

Step 1: Inventory data classes

Use Read and Grep to locate client secrets, access and refresh tokens, OAuth state/verifier, user/profile metadata, design references/content, assets, comments, job results, and logs.

Step 2: Define collection purpose

For each class, record purpose, explicit scope, source endpoint, owner, destination, processors, and whether collection can be avoided.

Step 3: Protect credentials

Store client secrets and user tokens in protected backend systems, separate access from refresh tokens, restrict operators, and exclude them from logs and backups where policy requires.

Step 4: Control content and URLs

Encrypt approved stored content, authorize every read, avoid durable storage of signed URLs, and derive expiry from current response evidence rather than a fixed assumption.

Step 5: Implement lifecycle

Use Write or Edit to apply policy-controlled expiration, consent revocation, account deletion, resource deletion, legal hold, and processor cleanup.

Step 6: Prove completion

Record counts, policy version, timestamps, opaque references, failed deletions, and follow-up owner without retaining deleted content in the receipt.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A user disconnects the integration. The service revokes or discards tokens, expires cached metadata and result references, schedules approved content deletion, and records a content-free receipt.

Error Handling

Canva Redacted Debug Bundle

Overview

Prefer references and classifications over raw data. The bundle should prove configuration and failure state while remaining safe to share with authorized responders.

Prerequisites

• Incident ID, UTC window, affected endpoint pattern, and deployment revision
• Approved evidence path, reviewer, retention, and deletion time
• Redaction denylist and current data-classification policy

Instructions

Step 1: Freeze a manifest

List each proposed artifact, purpose, source, classification, redaction rule, owner, and retention before collecting it.

Step 2: Collect local versions

Use Read and Grep to capture application/runtime version, pinned OpenAPI checksum, deployment/config revision, and feature flags without environment values.

Step 3: Collect failure envelopes

Record aggregate status/provider-code counts, endpoint patterns, opaque request/job references, and sanitized timestamps. Do not collect bodies or user/resource IDs.

Step 4: Add bounded connectivity evidence

If authorized, record DNS/TLS outcome and one non-mutating test-user status check. Exclude Authorization and response headers beyond an explicit safe allowlist.

Step 5: Review before packaging

Use Write or Edit to build the manifest and summary, scan for credential formats, URLs, personal data, and design content, then require a second-person review.

Step 6: Seal and expire

Hash the reviewed files, record access controls and deletion time, transfer through the approved channel, and verify deletion after closure.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A support bundle contains the release SHA, OpenAPI checksum, endpoint/status histogram, opaque export job reference, and sanitized timeline—never the export body, URL, token, or profile.

Error Handling

Canva Deployment and Callback Gate

Overview

Promote one immutable application artifact while keeping OAuth configuration and credentials environment-specific. Validate callbacks and a non-mutating Canva read before enabling user traffic.

Prerequisites

• Reviewed artifact digest and target environment
• Exact registered redirect URI and controlled HTTPS domain
• Secret backend, migration plan, health contract, and rollback version

Instructions

Step 1: Compare configuration

Use Read and Grep to diff redirect URI, scopes, preview features, callback/webhook routes, secret references, and data stores against the approved release.

Step 2: Stage runtime secrets

Inject environment-specific credentials from the approved backend. Never bake secrets or refresh tokens into images, frontend bundles, logs, or deployment output.

Step 3: Deploy traffic-disabled

Use Write or Edit for reviewed platform configuration, deploy the immutable artifact, run migrations with a rollback plan, and keep external traffic disabled.

Step 4: Verify callback safety

Confirm exact redirect matching, state validation, PKCE verifier handling, backend-only token exchange, cookie/session controls, and rejection of unexpected hosts.

Step 5: Run bounded readiness

Use a dedicated test user for a non-mutating identity/metadata read and verify redaction, dependency health, and version. Do not create content in a generic health endpoint.

Step 6: Promote or roll back

Enable traffic gradually under local SLOs. Restore the prior artifact/config and pause OAuth entry if authorization, data, or readiness evidence diverges.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

The same artifact moves from staging to production while each environment retains separate Canva credentials and redirect URIs. Traffic is enabled only after callback and read-only test evidence passes.

Error Handling

Canva Capability-Aware Authorization

Overview

Use Canva scopes and capabilities as provider inputs to your own authorization decision. Do not equate OAuth consent with tenant role, resource ownership, feature entitlement, or approval to process content.

Prerequisites

• Application roles, actions, tenants, and deny-by-default policy
• Current explicit Canva scopes and capability response contract
• Resource ownership and data-classification checks

Instructions

Step 1: Define the decision tuple

Name subject, tenant, application role, action, resource, environment, requested Canva operation, and data class.

Step 2: Separate provider inputs

Treat granted scopes, capability fields, resource access, and preview availability as independent facts. Absence, unknown values, or stale evidence must deny.

Step 3: Map application policy

Use Write or Edit to map each application action to minimum scopes, required capability evidence, ownership rule, approval, and audit class.

Step 4: Enforce server-side

Resolve the policy after authenticated tenant identity and before dispatch. Keep the generic Canva client unaware of business roles.

Step 5: Handle changes

Invalidate cached decisions after scope, membership, consent, capability, policy, or resource-owner changes; require reauthorization only when scopes changed.

Step 6: Audit without content

Record policy version, opaque subject/resource references, decision inputs, allow/deny result, and reason code without tokens or design contents.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

An application editor requests brand-template autofill. The backend checks tenant role, explicit design and template scopes, current capability/availability, template ownership, and data approval before submitting one job.

Error Handling

Canva Read-Only Connection Proof

Overview

Prove the smallest safe path first. A successful identity or profile read confirms connectivity and authorization shape but does not authorize design creation, export, assets, or other scopes.

Prerequisites

• Configured Canva integration and exact redirect URI
• Approved test user with the minimum identity/profile scope
• Backend secret storage and redacted evidence destination

Instructions

Step 1: Confirm backend boundary

Use Read and Grep to verify token exchange and storage stay server-side, the target base URL is exact, and no credential appears in client code.

Step 2: Select the read

Choose the minimum users/me or profile request supported by the granted explicit scope. Do not add design-write scopes for this proof.

Step 3: Send one request

Use the existing reviewed HTTP adapter and a bounded timeout. Do not print the Authorization header, response body, email, profile, or token metadata.

Step 4: Validate shape

Check status, content type, required response envelope, and only the minimum opaque identity field needed for correlation.

Step 5: Classify failure

Separate transport, invalid token, missing explicit scope, revoked consent, malformed response, and provider error using the redacted envelope.

Step 6: Record success

Use Write or Edit to save integration/config version, endpoint pattern, status category, schema result, latency bucket, and redaction check.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A new staging integration performs one users/me request for its dedicated test user and records only HTTP success, schema version, and an opaque internal connection reference.

Error Handling

Canva Incident Response

Overview

Contain impact before debugging deeply. Distinguish provider status, application release/config, tenant authorization, endpoint throttling, async-job backlog, and preview drift.

Prerequisites

• Incident ID, severity policy, affected operations, and UTC window
• Current deployment/config revisions and last known good
• Approved test user, rollback owner, and communications channel

Instructions

Step 1: Declare and bound

Record start time, reporter, user-visible symptom, affected tenants/operations, suspected data exposure, and current severity without copying customer content.

Step 2: Contain

Pause only unsafe mutations, refresh races, or affected queues. Preserve existing job identity and keep safe read-only paths available when policy permits.

Step 3: Check broad signals

Use Read and Grep to compare deployment/config changes, error/status trends, queue age, authorization failures, and Canva's official status/changelog.

Step 4: Run a minimal probe

Use an approved test user for one non-mutating endpoint. Never infer global provider health from a single production user.

Step 5: Mitigate and reconcile

Roll back the responsible release/config, reduce endpoint concurrency, disable a changed preview path, or reauthorize only affected users based on evidence. Reconcile queued jobs before resuming.

Step 6: Close with proof

Use Write or Edit to record timeline, decisions, impact, data assessment, recovery evidence, remaining jobs, rollback result, and preventive owner.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

After a release, one tenant sees export failures while other reads succeed. The operator pauses that tenant's export queue, rolls back the adapter, reconciles existing jobs, and avoids declaring a Canva-wide outage.

Error Handling

Canva OAuth Credential Boundary

Overview

Build authorization as a stateful backend protocol, not a copied token snippet. Keep the PKCE verifier and client secret out of the browser and serialize refresh-token replacement per user.

Prerequisites

• Developer Portal integration and saved client secret
• Controlled redirect URI and exact explicit scopes
• Backend session, token vault, encryption, and revocation path

Instructions

Step 1: Register the integration

Configure name, minimum scopes, at least one controlled redirect URI, and secret storage. Remove localhost and loopback redirect hosts from production configuration.

Step 2: Create authorization state

Generate high-entropy per-request state and a PKCE verifier that meets Canva's documented character/length rules. Store both server-side with short expiry and one-time use.

Step 3: Build the authorization URL

Use Canva's authorization endpoint, S256 challenge method, explicit space-separated scopes, client ID, state, and an exactly registered redirect URI.

Step 4: Validate the callback

Reject missing/mismatched/expired state, repeated codes, unexpected redirect context, and errors before token exchange.

Step 5: Exchange on the backend

Authenticate the token request using the approved client method, send the verifier and authorization code, validate the response, encrypt access and refresh tokens separately, and discard transient secrets.

Step 6: Refresh atomically

Single-flight refresh per user because each refresh token is single-use. Commit the new access token, expiry, and replacement refresh token atomically; reauthorize on unrecoverable failure.

Step 7: Support disconnect

Revoke when required, delete application-held tokens and cached authorization, and record a credential-free receipt.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A callback consumes a one-time state record and server-held verifier, exchanges the code on the backend, and stores the replacement refresh token in the same transaction that invalidates the prior token.

Error Handling

Canva Integration Hazard Review

Overview

Turn common failure patterns into evidence-backed findings rather than universal rules. Reconfirm time-sensitive provider behavior against current first-party contracts before enforcing it.

Prerequisites

• Repository scope, deployment/config version, and operation inventory
• Pinned OpenAPI, current docs, granted scopes, and preview surfaces
• Data policy, operation ledger, and redacted incident evidence

Instructions

Step 1: Review OAuth

Use Read and Grep to find browser-side secrets, missing state/PKCE validation, broad or implied scopes, refresh races, token logging, and incomplete disconnect cleanup.

Step 2: Review authorization

Check tenant and resource ownership, application role, explicit scopes, capabilities, and preview availability before every Canva-side action.

Step 3: Review async work

Find request handlers that block on long polling, lost job IDs, unbounded loops, duplicate submissions, and retries that do not reconcile existing state.

Step 4: Review throttling

Find guessed global quotas, fixed sleeps, assumed response headers, cross-tenant queues, and missing endpoint/user isolation.

Step 5: Review data and telemetry

Find cached signed URLs, retained content without purpose, token/profile logs, high-cardinality labels, and debug bundles without expiry or review.

Step 6: Review release posture

Find unpinned provider contracts, preview features on public-review paths, mutable deploys, missing rollback, and live CI on untrusted events.

Step 7: Record dispositions

Use Write or Edit to classify each finding with exact path/evidence, current provider source, severity, owner, safe fix, rollback, and verification test.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A review finds automatic retry wrapping design creation. The finding requires an operation ledger and existing-job reconciliation, rather than simply increasing a retry count.

Error Handling

Canva Bounded Capacity Test

Overview

Measure your application under a declared workload while honoring endpoint-specific Canva metadata and actual responses. Default to mocks; a live probe must be small, reversible, and isolated.

Prerequisites

• Approved workload model, test target, user count, and abort thresholds
• Mock contract plus current endpoint rate metadata
• Synthetic assets, dedicated users, cleanup plan, and provider-test authorization

Instructions

Step 1: Model operations

Define logical reads, writes, async submissions, polling, refresh, and webhook processing separately. Include bursts, retries, and job completion distribution.

Step 2: Exercise mocks first

Use Write or Edit to implement contract-faithful responses for success, throttling, auth failure, in-progress, terminal failure, and schema drift.

Step 3: Size application limits

Measure queue depth, worker utilization, latency, memory, refresh lock contention, and database pressure; set local admission and concurrency below measured safe points.

Step 4: Authorize a provider probe

Limit it to named endpoint/user, request count, duration, and synthetic data. Avoid mutating operations unless their cleanup and duplicate impact are approved.

Step 5: Abort aggressively

Stop on unexpected authorization, data, sustained throttling, provider error, cleanup failure, or impact outside the named test.

Step 6: Produce capacity evidence

Use Write or Edit to record workload, environment, contract version, aggregate results, observed provider responses, chosen headroom, and rollback.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A mock workload proves the export ledger and polling workers at expected burst. A small authorized live read then validates only endpoint behavior; it does not attempt to discover Canva's limits by saturation.

Error Handling

Canva Mock-First Local Loop

Overview

Make the default loop offline, deterministic, and safe. A live development check is exceptional and must not reuse production integrations, tokens, assets, or redirect configuration.

Prerequisites

• Existing project, package manager, and test framework
• Pinned OpenAPI/fixture version and adapter boundary
• Dedicated development integration and synthetic-user policy if live mode is approved

Instructions

Step 1: Inventory the project

Use Read and Grep to locate HTTP adapters, OAuth callback/state handling, fixtures, environment loading, token persistence, async job polling, and ignored files.

Step 2: Create contract fixtures

Use Write or Edit to model identity, designs, exports, assets, autofill, errors, throttling, and unknown fields at the transport boundary.

Step 3: Keep credentials out by default

Make tests fail if production-looking secrets are loaded. Never save tokens in a plaintext project file, browser storage, snapshot, or console.

Step 4: Test callback state

Exercise success, denial, state mismatch, expired/replayed callback, missing verifier, token-exchange failure, and atomic refresh replacement without real secrets.

Step 5: Test async reconciliation

Use deterministic clocks to cover in-progress, success, failed, timeout, retry, restart, and duplicate-delivery behavior.

Step 6: Run one approved live read

If required, use a dedicated development integration and test user for a non-mutating request, then delete ephemeral credentials and evidence under policy.

Step 7: Close production drift

Document every development redirect URI and remove localhost, loopback, and tunnel hosts before production review.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A developer runs fixtures for OAuth and export polling on every change. Once, a dedicated dev user performs a read-only connection proof; no token is written to the repository or browser.

Error Handling

Canva Integration Migration Program

Overview

Separate provider-contract, credential, application-data, and user-experience migrations. Preserve reversibility and reconcile every asynchronous or mutating operation before moving the next cohort.

Prerequisites

• Source and target operation/capability matrix
• Data inventory, rights, retention, consent, and identifier map
• Cohort plan, feature flag, validation sample, rollback, and owner

Instructions

Step 1: Define parity honestly

Use Read and Grep to map supported, changed, preview, unavailable, and intentionally retired operations. Do not invent workarounds for unsupported provider behavior.

Step 2: Design identity and consent

Keep Canva user/tenant identity separate from legacy IDs, request only explicit scopes, and identify when fresh user authorization is mandatory.

Step 3: Design data movement

Classify assets, designs, metadata, comments, and references; validate rights and format before transfer; avoid copying content that lacks an approved purpose.

Step 4: Build dual-path evidence

Use Write or Edit to add contract tests, operation identity, reconciliation, comparison receipts, and a feature-flagged target path without duplicating writes.

Step 5: Migrate a small cohort

Choose approved synthetic or low-risk users, enforce rate/admission controls, verify each result, and stop on authorization, data, or parity drift.

Step 6: Roll forward or back

Advance only from measured evidence. Roll back routing without losing target-side job/resource identity, then reconcile and clean partial artifacts.

Step 7: Close the legacy path

After the retention and rollback window, revoke unused credentials, delete approved stale data, remove old routes, and preserve a content-free audit receipt.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A legacy export path is replaced cohort by cohort. The application compares contract outcomes, routes one authorized cohort to Canva, and retains enough opaque identity to roll back and reconcile without double creation.

Error Handling

Canva Environment Isolation

Overview

Give each environment an independent Canva integration and trust boundary. Prevent a staging build, callback, credential, user, or token record from resolving to production.

Prerequisites

• Named environments, owners, domains, and deployment identities
• Separate Developer Portal integrations and redirect URIs
• Secret backend, token namespace, test-user, data, and audit policy per environment

Instructions

Step 1: Build the matrix

Use Read and Grep to map environment to integration ID, exact redirect hosts, scopes, preview features, secret references, token/data namespace, and owners.

Step 2: Separate integrations

Create or verify distinct Canva integrations where isolation is required. Never distinguish environments only with a runtime variable while sharing credentials.

Step 3: Constrain configuration

Use Write or Edit to validate environment identity, controlled host allowlists, exact callback routes, expected integration ID, and forbidden cross-environment values at startup.

Step 4: Isolate secrets and tokens

Use separate secret paths, encryption keys where policy requires, access policies, token tables or namespaces, backup rules, and rotation owners.

Step 5: Isolate users and data

Use synthetic development/staging users and assets. Prevent non-production workers, webhooks, or support tooling from reading production records.

Step 6: Test negative boundaries

Prove staging cannot use production client secrets, callbacks, tokens, queues, databases, or webhook routes; fail closed on mismatch.

Step 7: Record promotion rules

Document which artifact is shared, which configuration must differ, rollback, environment cleanup, and evidence needed before production.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

The same reviewed artifact runs in staging and production, but startup validation requires different integration IDs, callback hosts, vault paths, token namespaces, and test policies.

Error Handling

Canva Privacy-Safe Observability

Overview

Observe logical operations and provider requests separately. Keep metrics aggregate and logs content-free; do not assume undocumented rate-limit headers or fixed Canva latency thresholds.

Prerequisites

• Service and operation inventory plus local SLOs
• Telemetry allowlist/denylist, retention, and access controls
• Pinned endpoint/error/job contracts and incident routing

Instructions

Step 1: Define semantic signals

Name logical operation count, provider request count, status/provider-code class, latency distribution, job age/terminal state, queue depth, refresh result, and reconciliation outcome.

Step 2: Control dimensions

Allow method, normalized endpoint, environment, operation type, and coarse result. Exclude user, tenant, design, asset, token, URL, job, email, and raw error dimensions.

Step 3: Instrument the adapter

Use Write or Edit to create spans around authorized provider requests while keeping token refresh, job reconciliation, and business operations as distinct spans.

Step 4: Measure local rate budget

Track configured admission/concurrency and observed HTTP 429 by endpoint/user class. Record response retry instructions only when actually present; do not invent headroom gauges.

Step 5: Instrument async jobs

Measure age and terminal state from the persisted ledger, not from repeated submissions. Alert on reconciliation backlog and duplicate-attempt prevention.

Step 6: Set evidence-based alerts

Derive thresholds from application SLOs and measured baselines, require sustained windows, link runbooks, and avoid automatic scope, retry, or mutation changes.

Step 7: Validate redaction

Use Read and Grep against tests and sample telemetry to prove credentials, bodies, URLs, profiles, and resource identifiers cannot be emitted.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A dashboard shows export logical operations, provider submissions, in-progress age, terminal failures, and reconciliation backlog by environment and endpoint pattern—with no user or design labels.

Error Hand…

Canva Measured Performance Tuning

Overview

Change one controlled variable at a time and compare logical-operation outcomes, not just raw request latency. Never cache credentials or assume fixed Canva URL lifetimes and performance guarantees.

Prerequisites

• Baseline window, normalized endpoint, workload, and local SLO
• Current OpenAPI/response contract and endpoint rate metadata
• Cache data class, freshness/invalidation policy, feature flag, and rollback

Instructions

Step 1: Establish a baseline

Use Read and Grep to measure logical operations, provider calls, latency distribution, job completion, retries, cache hits, errors, and queue depth with synthetic or approved data.

Step 2: Identify the bottleneck

Separate network/connection latency, unnecessary fields, pagination, duplicate reads, write retries, polling cadence, token locks, worker capacity, and local storage.

Step 3: Design one experiment

Use Write or Edit to change one cache, pagination, connection, queue, or poll control behind a feature flag with explicit success and rollback thresholds.

Step 4: Protect caches

Cache only approved metadata, key by authorization boundary, encrypt where policy requires, and invalidate on writes, consent/ownership changes, or freshness expiry.

Step 5: Tune asynchronous polling

Persist job ID, begin with a short local interval, apply bounded exponential backoff, and stop at the application budget while reconciliation continues asynchronously.

Step 6: Validate and roll out

Compare correctness, freshness, duplicate prevention, resource use, and latency. Roll back on stale authorization, missed completion, increased errors, or throttling.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A service reduces design-list calls with a tenant- and user-authorized metadata cache. The experiment proves freshness and invalidation before rollout and never stores thumbnail or export URLs durably.

Error Handling

Canva Integration Policy Guardrails

Overview

Encode high-confidence invariants close to the code and verify them again at runtime. Keep provider-dependent facts versioned so a stale numeric limit or preview assumption cannot become permanent policy.

Prerequisites

• Policy document, owner, enforcement scope, and exception expiry
• Repository/runtime boundaries and pinned provider contract
• Current secret, scope, data, CI-event, and preview inventory

Instructions

Step 1: Classify controls

Separate immutable security controls from versioned provider-contract checks and local operational thresholds. Name the authority for each.

Step 2: Add secret controls

Use Write or Edit to block client secrets/tokens in source, frontend bundles, logs, snapshots, artifacts, and untrusted CI; scan examples and failure paths too.

Step 3: Add authorization controls

Require tenant/resource ownership, application policy, explicit minimum scopes, current capabilities, and preview status before dispatch.

Step 4: Add operation controls

Require operation identity for mutations, bounded retry classification, async job reconciliation, and scoped queues for throttling.

Step 5: Add contract controls

Pin OpenAPI or checksum, test unknown fields/statuses safely, detect deprecated/preview surface drift, and require review before regeneration.

Step 6: Add evidence controls

Use Read and Grep to verify each rule fires on a failing fixture, cannot be bypassed by formatting, and produces a redacted reason with owner and exception path.

Step 7: Govern exceptions

Make exceptions narrow, approved, time-bounded, visible in CI, and automatically fail after expiry.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A CI rule rejects Canva client secrets in browser configuration and privileged live tests on fork events; a runtime guard separately denies a design write without tenant ownership and explicit scope.

Error Handling

Canva Production Readiness Gate

Overview

Make go-live an evidence decision tied to an immutable artifact. Preview features, broad scopes, unsafe callback hosts, ambiguous jobs, or unverifiable rollback keep the release closed.

Prerequisites

• Release digest, configuration version, owner, and change scope
• Production integration, exact redirects, explicit scopes, and feature statuses
• Test receipts, migrations, observability, data policy, incident plan, and rollback

Instructions

Step 1: Verify identity and trust

Use Read and Grep to confirm exact artifact, environment, integration ID, callback hosts, backend-only secrets, CI event boundaries, and operator ownership.

Step 2: Verify authorization

Review minimum explicit scopes, tenant/resource checks, capabilities, consent changes, disconnect cleanup, and token-refresh serialization.

Step 3: Verify provider contracts

Pin current OpenAPI/changelog, identify deprecated and preview APIs, and confirm public-review eligibility. Canva states public integrations using preview features cannot pass review.

Step 4: Verify operations

Prove operation identity, bounded retry, endpoint/user queueing, async job reconciliation, webhook idempotency if used, and partial-failure cleanup.

Step 5: Verify data and telemetry

Prove content/credential classification, retention/deletion, URL handling, log redaction, low-cardinality metrics, alert ownership, and debug-bundle expiry.

Step 6: Exercise failure and rollback

Use Write or Edit to record mocked failures, protected read-only integration proof, migration recovery, rollback command/path, and post-rollback reconciliation.

Step 7: Approve or refuse

Record exact evidence, approver, residual risks, and activation steps. Refuse if any required fact is inferred rather than proven.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A public release using a preview webhook path is refused. The team ships the non-preview core after exact-head tests and keeps the preview feature in a separate non-public experiment.

Error Handling

Canva Endpoint Throttling Control

Overview

Canva limits vary by endpoint and are represented in current endpoint/OpenAPI metadata. Do not invent daily export quotas or assume universal headroom/reset headers.

Prerequisites

• Normalized endpoint, user/tenant class, traffic profile, and current metadata
• Operation idempotency/reconciliation behavior and local retry budget
• Queue ownership, observability, and abort/rollback thresholds

Instructions

Step 1: Load current metadata

Use Read and Grep to identify the exact operation and its current endpoint rate annotation. Keep the contract version with the limiter configuration.

Step 2: Classify the request

Separate safe reads, async status polls, mutating submissions, token exchange, and public key reads. Never share one undifferentiated global bucket.

Step 3: Persist mutation identity

Record application operation identity and any returned job ID before considering retry. Reconcile existing state after ambiguous transport failure.

Step 4: Respond to throttling

Pause the affected endpoint/user queue. Honor documented response instructions when present; otherwise apply bounded exponential backoff with jitter under a deadline.

Step 5: Control concurrency

Use Write or Edit to enforce admission, concurrency, queue age, retry count, and circuit/abort limits below the current known ceiling and measured application capacity.

Step 6: Detect drift

Alert on sustained 429s, changed endpoint metadata, queue starvation, or new operation shapes; require review rather than automatically increasing throughput.

Step 7: Prove recovery

Record contract version, scoped limiter state, observed responses, reconciliation result, and whether traffic returned without duplicates.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

Export submissions and export-status polls use separate controls. After an ambiguous timeout, the service checks the existing job instead of consuming capacity by submitting another export.

Error Handling

Canva Production Reference Architecture

Overview

Separate browser experience, backend OAuth/policy, provider adapter, durable operation ledger, workers, and controlled data stores. The architecture must prevent cross-tenant access and duplicate mutation by construction.

Prerequisites

• Operations, tenants, traffic, data classes, and recovery objectives
• Scopes, capabilities, preview dependencies, and public-review posture
• Secret/token store, operation ledger, queue, observability, and rollback platform

Instructions

Step 1: Draw trust boundaries

Map browser, callback, backend, policy service, token vault, Canva adapter, job ledger, worker queue, data store, telemetry, and provider edges.

Step 2: Own authorization centrally

Resolve authenticated tenant, application role, resource ownership, explicit scope, capability, feature status, and data purpose before the adapter.

Step 3: Own tokens separately

Keep client secret and tokens backend-only, encrypt access and refresh tokens separately, serialize per-user refresh, and atomically replace single-use refresh tokens.

Step 4: Own mutation identity

Create a durable operation record before provider dispatch, attach returned resource/job identity, and reconcile terminal state across retries and restarts.

Step 5: Own data lifecycle

Store minimum approved metadata/content, authorize every read, expire temporary references, implement consent/account deletion, and keep protected values out of telemetry.

Step 6: Own failure recovery

Use endpoint-scoped admission, bounded retries, dead letters with reconciliation state, feature flags, immutable deploys, and exercised rollback.

Step 7: Record the blueprint

Use Write or Edit to document responsibilities, interfaces, schemas, threat decisions, SLOs, failure modes, and verification evidence.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

The browser never receives a client secret or refresh token. The backend policy service authorizes an export, the ledger preserves identity, a worker polls the same job, and the application mediates result de…

Canva Reconciliation and Recovery

Overview

Reliability begins with knowing whether an operation happened. Reconcile existing resources and jobs before replaying a mutation, and keep credential rotation outside generic request retries.

Prerequisites

• Operation types, retry classifications, and duplicate impact
• Durable identity/job ledger and terminal-state contract
• Endpoint/user queues, time budgets, alert owner, and rollback

Instructions

Step 1: Classify operations

Use Read and Grep to label safe read, token exchange, mutating submission, job poll, webhook delivery, and cleanup. Define retriable errors per operation.

Step 2: Persist before dispatch

Create one application operation record with tenant/resource authorization and intended effect before sending a mutating request.

Step 3: Handle ambiguous failure

After timeout or connection loss, use returned or recoverable identity to query existing state. Never blindly recreate a design, export, upload, or autofill.

Step 4: Poll bounded jobs

Apply exponential backoff with jitter to the same job, stop at local deadline, continue later from durable state, and handle success/failed plus unknown future states safely.

Step 5: Serialize credential refresh

Single-flight by Canva user, atomically store the returned replacement refresh token, wake waiting requests on success, and reauthorize rather than looping invalid credentials.

Step 6: Use scoped circuits and dead letters

Open by endpoint/failure class, preserve operations with reconciliation state, and require an owner before replay. Do not mix authorization failures with provider availability.

Step 7: Prove recovery

Use Write or Edit to test restart, duplicate delivery, lost response, throttling, terminal failure, refresh race, circuit recovery, and dead-letter replay.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A network timeout follows export submission. The worker retains the operation and job reference, resumes polling after restart, and never submits a second export merely because the response was uncertain.

Er…

Canva Typed REST Adapter

Overview

Treat the adapter as a transport boundary, not an authorization oracle or official Canva SDK. Keep policy and token rotation outside generic request methods, and tolerate documented non-breaking response additions.

Prerequisites

• Language/runtime, package policy, and required operations
• Pinned OpenAPI bytes/checksum and generation configuration
• Authorization, token, data, retry, and test boundaries

Instructions

Step 1: Select the minimal surface

Use Read and Grep to list only required operations, scopes, request/response shapes, async job states, and preview flags.

Step 2: Pin generation inputs

Store or checksum the OpenAPI contract and generator version. Review endpoint, scope, enum, validation, and preview changes before regeneration.

Step 3: Define adapter interfaces

Use Write or Edit to expose explicit operation methods, normalized errors, response validation, timeout context, and opaque request/job metadata.

Step 4: Keep policy outside

Require an already-authorized tenant/resource decision and token lease. Do not let a generic client select roles, broaden scopes, refresh concurrently, or log bodies.

Step 5: Handle responses safely

Validate required fields, accept additive unknown fields where the contract allows, reject unsafe type/status drift, and model in-progress/success/failed without exhaustive assumptions about preview enums.

Step 6: Constrain retries

Retry only classified safe reads or reconciled operations under a bounded policy. Return authorization and throttling facts to their owning layers.

Step 7: Test contract drift

Exercise fixtures for success, provider errors, unknown fields, changed enums, malformed bodies, timeouts, duplicate prevention, and redaction.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A generated TypeScript transport covers users, designs, and exports, but an application service still owns tenant authorization, refresh serialization, operation identity, and result retention.

Error Handling

Canva Integration Security Baseline

Overview

Protect client secrets and user tokens as separate high-impact credentials. Enforce authorization before provider access and treat preview webhook verification as an additional boundary, not proof of business authorization.

Prerequisites

• Integration ID, environments, operations, tenants, and threat scope
• Current scopes, redirect URIs, token stores, and data flows
• Webhook/preview use, incident response, secret scanning, and audit controls

Instructions

Step 1: Inventory secrets and flows

Use Read and Grep to locate client secrets, access/refresh tokens, PKCE verifier, OAuth state, callbacks, browser bundles, logs, backups, jobs, and external processors.

Step 2: Harden OAuth

Require controlled redirect hosts, one-time state/verifier, backend token exchange, encrypted and separated tokens, per-user refresh serialization, revocation, and disconnect cleanup.

Step 3: Minimize authorization

Request explicit minimum scopes and enforce tenant, resource, role, capability, purpose, and preview status server-side before every action.

Step 4: Harden data and logs

Use Write or Edit to prevent tokens, bodies, signed URLs, personal data, and resource identifiers from routine logs; protect stored content and deletion workflows.

Step 5: Verify webhooks

For authorized preview use, validate the signed token/claims against cached Canva JWKs, select by case-sensitive key ID, refetch only for unknown keys, enforce replay/idempotency controls, and authorize resulting actions separately.

Step 6: Harden dependencies and deployment

Pin provider/client inputs, scan secrets, isolate environments, protect CI from forks, deploy immutably, and maintain tested rollback and credential rotation.

Step 7: Prove controls

Test state mismatch, token leak prevention, cross-tenant denial, refresh races, scope denial, unknown webhook key, replay, revoked consent, and account deletion.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A valid Canva webhook signature is accepted only as authenticity evidence. The router stil…

Canva Contract Upgrade

Overview

Canva uses date-based Connect API versions while the path v1 is an epoch marker. Preview features may change without a new version, so upgrade evidence must include feature status and live protected checks.

Prerequisites

• Current OpenAPI/checksum, generated code, and deployment version
• Target OpenAPI/changelog and affected operation inventory
• Compatibility suite, migration owner, rollout window, and rollback

Instructions

Step 1: Freeze both contracts

Use Read and Grep to record exact source URLs, retrieval times, bytes/checksums, API version metadata, generator version, and current deployed artifact.

Step 2: Classify the diff

Review endpoints, methods, scopes, required inputs, validation, enums, response requiredness, error/status behavior, deprecations, and preview changes.

Step 3: Map consumers

Find adapters, schemas, fixtures, policies, UI assumptions, queues, data stores, metrics, and runbooks that depend on each changed fact.

Step 4: Build compatibility

Use Write or Edit to update code and add old/new fixtures for success, error, unknown additive fields, changed enums, async states, redaction, and rollback.

Step 5: Protect authorization

Treat any scope or capability change as an authorization migration requiring portal configuration and possibly fresh user consent; never silently broaden.

Step 6: Roll out gradually

Ship an immutable feature-flagged artifact to a protected environment, run mocked plus read-only live evidence, then expose a bounded cohort under local thresholds.

Step 7: Reconcile and close

Roll back on drift, preserve job/resource identity across versions, remove deprecated code after the window, and record exact evidence and residual preview risk.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

An OpenAPI diff adds a response field and changes a preview enum. The adapter accepts the additive field, handles unknown preview values safely, and deploys behind a flag without changing scopes.

Error Handling

Canva Preview Webhook Intake

Overview

Authenticate every notification with Canva's rotating public JWK set, then apply separate tenant/resource authorization and idempotency. Webhooks are outgoing-only and do not replace the Comments API for replies.

Prerequisites

• Eligible integration and explicitly approved preview use
• Controlled HTTPS callback, required scopes, and notification allowlist
• Durable idempotency store, queue, retention, and incident owner

Instructions

Step 1: Confirm eligibility

Use Read and Grep to verify current preview status, public-review posture, required collaboration plus notification-specific scopes, and enabled notification types.

Step 2: Fetch and cache keys

Use the public unauthenticated connect/keys endpoint, cache the rotating Ed25519/OKP JWK set, select by case-sensitive key ID, and refetch only once for an unknown key.

Step 3: Verify before parsing actions

Validate signature and documented token claims, reject wrong issuer/audience/time/context, cap request size, and retain no raw signed token in logs.

Step 4: Defend against replay

Create a durable idempotency key from the verified notification identity, enforce an application retention window, and acknowledge duplicates without repeating effects.

Step 5: Authorize the event

Resolve tenant, user/resource ownership, notification type, feature status, and application policy. A valid signature does not authorize a write or reply.

Step 6: Queue and process

Use Write or Edit to persist only approved fields and enqueue after verification. Return the protocol response required by the current docs without waiting on downstream side effects.

Step 7: Reconcile and observe

Record verification class, normalized type, duplicate state, queue result, redacted error, and handler version; dead-letter safely and require owner-reviewed replay.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A verified comment notification is deduplicated and routed to an authorized tenant queue. Any response comment is sent separately through the current Comments API after …