Canva Integration Security Baseline

Overview

Protect client secrets and user tokens as separate high-impact credentials. Enforce authorization before provider access and treat preview webhook verification as an additional boundary, not proof of business authorization.

Prerequisites

• Integration ID, environments, operations, tenants, and threat scope
• Current scopes, redirect URIs, token stores, and data flows
• Webhook/preview use, incident response, secret scanning, and audit controls

Instructions

Step 1: Inventory secrets and flows

Use Read and Grep to locate client secrets, access/refresh tokens, PKCE verifier, OAuth state, callbacks, browser bundles, logs, backups, jobs, and external processors.

Step 2: Harden OAuth