Canva OAuth Credential Boundary

Overview

Build authorization as a stateful backend protocol, not a copied token snippet. Keep the PKCE verifier and client secret out of the browser and serialize refresh-token replacement per user.

Prerequisites

• Developer Portal integration and saved client secret
• Controlled redirect URI and exact explicit scopes
• Backend session, token vault, encryption, and revocation path

Instructions

Step 1: Register the integration

Configure name, minimum scopes, at least one controlled redirect URI, and secret storage. Remove localhost and loopback redirect hosts from production configuration.

Step 2: Create authorization state