canva-prod-checklist

# Canva Production Checklist ## Overview Complete checklist for deploying Canva Connect API integrations to production, covering OAuth configuration, security, error handling, monitoring, and Canva's integration review process. ## Pre-Deployment ### OAuth & Security - [ ] Client ID and secret stored in secret manager (not env files) - [ ] Redirect URIs use HTTPS and match production domains - [ ] Only required OAuth scopes requested (least privilege) - [ ] Access tokens stored encrypted at rest - [ ] Refresh token rotation handled (single-use tokens) - [ ] Token revocation implemented for user disconnect - [ ] No client secrets in frontend code ### API Integration - [ ] All API calls use `api.canva.com/rest/v1/*` endpoints - [ ] Rate limits respected with exponential backoff (see `canva-rate-limits`) - [ ] Export polling implemented with timeout (don't poll forever) - [ ] 429 responses handled with `Retry-After` header - [ ] 401 responses trigger automatic token refresh - [ ] Error responses parsed and logged (without tokens) - [ ] Blank designs auto-delete warning handled (7-day window) - [ ] Export download URLs consumed within 24-hour window ### Webhook Security - [ ] Webhook endpoint uses HTTPS - [ ] JWK signature verification implemented (see `canva-webhooks-events`) - [ ] Webhook handler returns 200 immediately - [ ] Heavy processing done asynchronously - [ ] Idempotency keys prevent duplicate processing ### Data Handling - [ ] No access tokens in log output - [ ...