canva-prod-checklist

name	canva-prod-checklist
description	Execute Canva Connect API production deployment checklist and go-live procedures. Use when deploying Canva integrations to production, preparing for launch, or validating production readiness. Trigger with phrases like "canva production", "deploy canva", "canva go-live", "canva launch checklist".
allowed-tools	Read, Bash(kubectl:*), Bash(curl:*), Grep
version	1.0.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","design","canva"]
compatible-with	claude-code

Canva Production Checklist

Overview

Complete checklist for deploying Canva Connect API integrations to production, covering OAuth configuration, security, error handling, monitoring, and Canva's integration review process.

Pre-Deployment

OAuth & Security

• Client ID and secret stored in secret manager (not env files)
• Redirect URIs use HTTPS and match production domains
• Only required OAuth scopes requested (least privilege)
• Access tokens stored encrypted at rest
• Refresh token rotation handled (single-use tokens)
• Token revocation implemented for user disconnect
• No client secrets in frontend code

API Integration

• All API calls use api.canva.com/rest/v1/* endpoints
• Rate limits respected with exponential backoff (see canva-rate-limits)
• Export polling implemented with timeout (don't poll forever)
• 429 responses handled with Retry-After header
• 401 responses trigger automatic token refresh
• Error responses parsed and logged (without tokens)
• Blank designs auto-delete warning handled (7-day window)
• Export download URLs consumed within 24-hour window

Webhook Security

• Webhook endpoint uses HTTPS
• JWK signature verification implemented (see canva-webhooks-events)
• Webhook handler returns 200 immediately
• Heavy processing done asynchronously