canva-deploy-integration

# Canva Deploy Integration ## Overview Deploy Canva Connect API integrations to popular platforms with secure OAuth credential management. The Canva API requires server-side token exchange — client secrets and refresh tokens must never reach the browser. ## Prerequisites - Canva OAuth credentials (client ID + secret) - Platform CLI installed (vercel, fly, or gcloud) - HTTPS domain for OAuth redirect URIs - Application code ready for deployment ## Vercel ### Secrets ```bash # Add Canva OAuth credentials vercel env add CANVA_CLIENT_ID production vercel env add CANVA_CLIENT_SECRET production vercel env add CANVA_REDIRECT_URI production # e.g. https://your-app.vercel.app/auth/canva/callback ``` ### vercel.json ```json { "functions": { "api/**/*.ts": { "maxDuration": 30 } }, "headers": [ { "source": "/api/(.*)", "headers": [ { "key": "Cache-Control", "value": "no-store" } ] } ] } ``` ### API Route (Next.js / Vercel Functions) ```typescript // api/canva/callback.ts — OAuth callback export async function GET(req: Request) { const url = new URL(req.url); const code = url.searchParams.get('code'); const state = url.searchParams.get('state'); // Exchange code for tokens (server-side only) const tokens = await exchangeCodeForToken({ code: code!, codeVerifier: await getVerifierFromSession(state!), clientId: process.env.CANVA_CLIENT_ID!, clientSecret: process.env.CANVA_CLIENT_SECRET!, redire...