Does Canva rotate refresh tokens and revoke access tokens immediately when OAuth scopes are reduced?

Question

When building an integration against the Canva Connect API, teams must decide how to enforce least-privilege access over time. The OAuth 2.0 authorization code flow lets an app request specific scopes, but those scopes operate at the resource level rather than the record level. Because access tokens are short-lived, an integration must store and use refresh tokens to maintain sessions. The uncertainty is that public documentation does not clearly define whether refresh tokens are rotated on each exchange, what their maximum lifetime is, or whether a token revocation endpoint exists to invalidate outstanding credentials immediately. In addition, reducing an app's granted scopes may not retroactively invalidate tokens issued earlier, so a least-privilege reduction can lag behind actual credential validity. Since token policies can be version-sensitive, behavior should be confirmed against the specific Canva Connect API version in use.

Does Canva rotate refresh tokens on every token exchange, and is replay of an old refresh token rejected? Is there a documented revocation mechanism that immediately disables access tokens when a user disconnects the integration? Do changes to an app's OAuth scopes invalidate previously issued tokens, or must the integration wait for natural expiry?

Tasadduq Burney · Answer

Direct answer
Public Canva Connect API documentation does not confirm that refresh tokens are rotated on every exchange, that replayed refresh tokens are rejected, that a revocation endpoint immediately disables access tokens, or that reducing OAuth scopes invalidates previously issued tokens. Until you verify against your specific app version, assume the opposite: outstanding access tokens remain usable until natural expiry, and scope reductions apply only to new authorizations.

Confirmed context versus unconfirmed behavior
Confirmed: Canva Connect API uses OAuth 2.0 authorization code flow with access tokens and refresh tokens for long-lived integrations, and token lifetimes and rotation policies can be version-sensitive.
Not confirmed by public documentation: per-exchange refresh-token rotation, replay rejection, token revocation on user disconnect, and retroactive scope invalidation.

Why this matters for least privilege
If an integration reduces an app's granted scopes, previously issued access tokens may keep their broader scope until they expire. A user disconnect may stop future refreshes without instantly invalidating short-lived access tokens already in circulation.

Verification steps for your integration

Review the current Canva Connect API authentication reference for your app's API version; note any stated access-token lifetime and refresh-token policy.
In a sandbox OAuth app, exchange an authorization code for an access token and refresh token.
Attempt to reuse the same refresh token for a second exchange. If it is accepted, rotation and replay rejection are not enforced in your version.
Reduce the app's scopes, issue a new token, and call a protected endpoint with the older, broader-scoped token until it expires to confirm whether scope reduction is retroactive.
Trigger a user disconnect or deauthorization and test whether an outstanding access token still succeeds immediately afterward.

Safe scoped command example
curl -X POST <CANVA_TOKEN_ENDPOINT_VERIFIED_IN_DOCS> \
  -d grant_type=refresh_token \
  -d refresh_token=YOUR_SANDBOX_REFRESH_TOKEN \
  -d client_id=YOUR_SANDBOX_CLIENT_ID \
  -d client_secret=YOUR_SANDBOX_CLIENT_SECRET
Replace placeholder values with sandbox credentials only. Confirm the exact token endpoint path in current Canva documentation before use; do not send production secrets.

Missing diagnostic detail
Which Canva Connect API version and OAuth app environment (sandbox or production) are you using? Token rotation, lifetime, and revocation behavior may differ by version, and this determines whether you must shorten access-token lifetimes or implement your own revocation tracking.

This is a conservative draft pending verification against current Canva Connect API documentation. Do not implement calls to an undocumented revocation endpoint.

Does Canva rotate refresh tokens and revoke access tokens immediately when OAuth scopes are reduced?

1 answer

Direct answer

Confirmed context versus unconfirmed behavior

Why this matters for least privilege

Verification steps for your integration

Safe scoped command example

Missing diagnostic detail

Your perspective belongs here.

0 question comments