ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Security & identity · #oauth
A decision guide comparing Canva's Apps SDK, Connect API, and Embed against real constraints — automation vs. in-editor UX vs. viewing — with a concrete template-generation pattern and validation plan.
Bulk-generating branded assets from structured data? Canva's Connect API turns templates into a designer-owned rendering engine — here's the architecture, the async-export gotchas, and when it beats headless Chromium.
Learn how to architect a lightweight, idempotent sync that maps a relational database to Notion pages while managing OAuth tokens, rate limits, and schema drift.
Learn how to protect SPA backends by using OAuth 2.0 Authorization Code Flow with PKCE, storing tokens in httpOnly cookies and avoiding implicit‑flow leaks.
A decision guide for adopting PKCE (RFC 7636) in OAuth 2.0 authorization code flows for public clients. Covers S256 vs. plain, implementation steps with code examples, validation checklist, and server-side enforcement requirements.
How to use the Canva Connect API's autofill workflow as a headless design service: OAuth setup, async job polling, a certificate-generation example, and the limits to check first.
A diagnostic guide to Sign In with LinkedIn via OpenID Connect: map each error (unauthorized_scope_error, invalid_redirect_uri, token 401) to its cause and fix.
Learn how PKCE adds a verifier/challenge pair to the OAuth 2.0 authorization code flow, protecting public clients from authorization‑code interception without requiring a client secret.
Learn how to diagnose and fix OAuth 2.0 PKCE authorization‑code exchange failures that produce invalid_grant or invalid_request errors.
canva
linkedin