Canva Production Checklist

Overview

Complete checklist for deploying Canva Connect API integrations to production, covering OAuth configuration, security, error handling, monitoring, and Canva's integration review process.

Pre-Deployment

OAuth & Security

• Client ID and secret stored in secret manager (not env files)
• Redirect URIs use HTTPS and match production domains
• Only required OAuth scopes requested (least privilege)
• Access tokens stored encrypted at rest
• Refresh token rotation handled (single-use tokens)
• Token revocation implemented for user disconnect
• No client secrets in frontend code