Canva Apps SDK: OAuth-scoped access to designs with a minimal manifest

Use editor-integrated apps with user-consented OAuth, not shared credentials

If you need to list, read or create designs on behalf of Canva users, the supported path is the Canva Apps SDK with OAuth 2.0 authorization and a manifest-declared scope set. The app runs inside the Canva UI and can only act on resources the user explicitly approves. That consent boundary is enforced by the scopes declared in the manifest and by short-lived access tokens issued per user.

OAuth 2.0 is the authorization framework Canva uses for third-party apps. A manifest is a configuration registered in the Canva developer console that declares the app name, entry points and the permissions, called scopes, that the app requests. Scopes are narrow and additive, such as design:read, design:write and asset:read.

How the consent and token flow works

Install starts in Canva. The user opens the app, Canva redirects to an authorization endpoint with the scopes from the manifest and your registered redirect URI. After approval, Canva redirects back to your backend with an authorization code. Your backend exchanges that code for an access token and a refresh token using your client ID and client secret. Subsequent API calls from your backend send the access token in the Authorization header. All operations are scoped to the consenting user and limited to the permissions declared.

Access tokens are short lived. Refresh tokens must be stored securely and used to obtain new access tokens for background jobs. Assuming a token stays valid indefinitely leads to failures once it expires.

Minimal manifest and backend wiring

The manifest is registered in the Canva developer console and linked to the app. A minimal configuration for read and write access to designs plus read access to assets follows this structure:

{
  "name": "Design Sync",
  "scopes": ["design:read", "design:write", "asset:read"],
  "redirect_uri": "https://your-domain.example/auth/callback",
  "entry_points": {
    "editor": {
      "type": "webview",
      "url": "https://your-domain.example/app"
    }
  }
}

Replace your-domain.example with your backend host. The redirect URI must exactly match the value registered in the console, including scheme and path. Mismatches cause the OAuth exchange to fail.

The token exchange runs on your backend server, which needs permission to read your client secret from secure storage. The callback endpoint receives the authorization code and posts it to Canva's token endpoint:

// Run on your backend server, e.g. a Node/Express route
// Requires client_id and client_secret from the developer console
POST https://api.canva.com/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
code=<AUTHORIZATION_CODE>
redirect_uri=https://your-domain.example/auth/callback
client_id=<CLIENT_ID>
client_secret=<CLIENT_SECRET>

The response contains an access_token, a refresh_token and the granted scope list. Store the refresh token encrypted at rest. Use the access token for supported calls such as listing a user's designs, reading design metadata, or creating a design from a template. Every call includes the header Authorization: Bearer <ACCESS_TOKEN>. Operations remain scoped to the consenting user and cannot cross accounts.

Limits and common mistakes

• Scopes are narrow and additive. Requesting overly broad scopes causes install rejection; requesting too few causes runtime permission errors when the API is called.
• App functionality is limited to the SDK surface. Direct pixel-level editing is not available, only supported API actions and UI extensions.
• Access tokens are short lived. Background jobs that assume a token remains valid fail after expiry unless they handle refresh tokens.
• Manifest and SDK behavior is version sensitive. A manifest accepted today may require updates after platform changes.

Verify before production use

1. Create a test app in the Canva developer console and inspect manifest validation to confirm the accepted scopes and redirect URI format.
2. Install the test app in a Canva sandbox account, complete the OAuth flow, and inspect the token response for the scope grant and expiry fields.
3. Make a read-only API call with the issued token and confirm it succeeds within scope, then attempt a call requiring a non-granted scope and confirm it is rejected.
4. Check app logs after the access token expires to confirm refresh handling works as expected.

Scope names and manifest fields shown here follow the documented pattern for the Apps SDK; because the platform is version sensitive, confirm them against the current Canva developer documentation before submitting your app for review.