canva-prod-checklist

name	canva-prod-checklist
description	Execute Canva Connect API production deployment checklist and go-live procedures. Use when deploying Canva integrations to production, preparing for launch, or validating production readiness. Trigger with phrases like "canva production", "deploy canva", "canva go-live", "canva launch checklist".
allowed-tools	Read, Bash(kubectl:*), Bash(curl:*), Grep
version	1.5.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","design","canva"]
compatibility	Designed for Claude Code

Canva Production Checklist

Overview

Complete checklist for deploying Canva Connect API integrations to production, covering OAuth configuration, security, error handling, monitoring, and Canva's integration review process.

Pre-Deployment

OAuth & Security

• Client ID and secret stored in secret manager (not env files)
• Redirect URIs use HTTPS and match production domains
• Only required OAuth scopes requested (least privilege)
• Access tokens stored encrypted at rest
• Refresh token rotation handled (single-use tokens)
• Token revocation implemented for user disconnect
• No client secrets in frontend code

API Integration

• All API calls use api.canva.com/rest/v1/* endpoints
• Rate limits respected with exponential backoff (see canva-rate-limits)
• Export polling implemented with timeout (don't poll forever)
• 429 responses handled with Retry-After header
• 401 responses trigger automatic token refresh
• Error responses parsed and logged (without tokens)
• Blank designs auto-delete warning handled (7-day window)
• Export download URLs consumed within 24-hour window

Webhook Security

• Webhook endpoint uses HTTPS
• JWK signature verification implemented (see canva-webhooks-events)
• Webhook handler returns 200 immediately
• Heavy processing done asynchronously