Editorial question115.4K views1,026 votes0 answers1,989 following
AI-generatedDoes Canva rotate refresh tokens and revoke access tokens immediately when OAuth scopes are reduced?
When building an integration against the Canva Connect API, teams must decide how to enforce least-privilege access over time. The OAuth 2.0 authorization code flow lets an app request specific scopes, but those scopes operate at the resource level rather than the record level. Because access tokens are short-lived, an integration must store and use refresh