canva-security-basics

# Canva Security Basics ## Overview Security best practices for Canva Connect API OAuth 2.0 tokens, client credentials, and webhook verification. The Canva API uses OAuth with PKCE — there are no static API keys. ## Token Security ### Never Expose Client Secrets ```bash # .env (NEVER commit) CANVA_CLIENT_ID=OCAxxxxxxxxxxxxxxxx CANVA_CLIENT_SECRET=xxxxxxxxxxxxxxxx # .gitignore — mandatory entries .env .env.local .env.*.local ``` ```typescript // WRONG — client-side JavaScript can't safely hold secrets // Token exchange and refresh MUST happen server-side // "Requests that require authenticating with your client ID and // client secret can't be made from a web-browser client" — Canva docs ``` ### Token Storage ```typescript // Store tokens encrypted at rest — they grant access to user's Canva account interface SecureTokenStore { save(userId: string, tokens: { accessToken: string; // Valid ~4 hours refreshToken: string; // Single-use — always save the latest expiresAt: number; }): Promise<void>; get(userId: string): Promise<CanvaTokens | null>; delete(userId: string): Promise<void>; } // Production: use your database with encryption // Never store tokens in: localStorage, cookies without httpOnly, log files, git ``` ### Token Revocation ```typescript // Revoke tokens when user disconnects your integration async function revokeCanvaToken(token: string, clientId: string, clientSecret: string) { const basicAuth = Buffer.from(`${clientId}:${clie...