Building a Canva Content App: Working Within the Iframe Sandbox
Learn how to build a Canva content app that respects the iframe sandbox, uses the editor API for design changes, and navigates OAuth, rate limits, and the review pipeline.
Loading…
ReadMeFeed / Community knowledge
#iframe-sandbox
Real questions. Useful conversations. Find the people who know your stack.
CodePen Embedded Pens: Architecture, Isolation Guarantees, and Operational Verification
An architecture note on CodePen's Embedded Pens: the minimal stateless design, sandbox and CSP trust boundaries, operational verification steps, failure modes, and design change triggers that would require re-evaluating isolation guarantees.
codepenBuilding Canva Apps: Working Within the Iframe Sandbox and Performance Budget
Canva Apps run in a locked-down iframe with a 200 KB budget and a typed RPC layer. This post walks through the architectural constraints — message-passing, design tokens, rate limits — and shows a concrete content-extension pattern that passes review.
canva