Canva Deployment and Callback Gate

Overview

Promote one immutable application artifact while keeping OAuth configuration and credentials environment-specific. Validate callbacks and a non-mutating Canva read before enabling user traffic.

Prerequisites

• Reviewed artifact digest and target environment
• Exact registered redirect URI and controlled HTTPS domain
• Secret backend, migration plan, health contract, and rollback version

Instructions

Step 1: Compare configuration

Use Read and Grep to diff redirect URI, scopes, preview features, callback/webhook routes, secret references, and data stores against the approved release.

Step 2: Stage runtime secrets