Canva

Overview

Connect your users to Canva for design creation, brand management, and asset collaboration.

Property	Value
Provider ID	canva
Category	Design
PKCE	Required
Token refresh	Automatic
Redirect URI	Shown in Developer Portal

Step 1: Create a Canva Integration

Go to the Canva Developer Portal

Navigate to canva.com/developers/integrations and sign in.

Create an integration

Click Create an integration.

Add the redirect URL

Under Authentication, add the Redirect URI from the Developer Portal to Redirect URLs.

Select scopes

Select the scopes your integration needs. See Available Scopes below.

Get credentials

Copy the Client ID and Client Secret.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Canva provider

Go to OAuth Providers > Add Provider > Canva.

Enter credentials

• Client ID: Paste your Canva Client ID
• Client Secret: Paste your Canva Client Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
design:content:read	Read access to design content
design:content:write	Write access to design content
design:meta:read	Read access to design metadata
folder:read	Read access to folders
folder:write	Write access to folders
asset:read	Read access to uploaded assets
asset:write	Upload and manage assets
brandtemplate:content:read	Read access to brand template content
brandtemplate:meta:read	Read access to brand template metadata
profile:read	Read access to user profile information

Notes

• PKCE is required for all Canva OAuth flows.
• Scopes configured in your Canva integration must match the scopes you request during authorization.
• See the Canva Connect authentication documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
createThread	send	POST	/rest/v1/designs/{designId}/comments
deleteAsset	delete	DELETE	/rest/v1/assets/{assetId}
deleteFolder	delete	DELETE	/rest/v1/folders/{folderId}
createFolder	admin, write	POST	/rest/v1/folders
CreateAssetUploadJob	write	POST	/rest/v1/asset-uploads
createDesign	write	POST	/rest/v1/designs
createDesignAutofillJob	write	POST	/rest/v1/autofills
createDesignExportJob	write	POST	/rest/v1/exports
createDesignImportJob	write	POST	/rest/v1/imports
createUrlAssetUploadJob	write	POST	/rest/v1/url-asset-uploads
moveFolderItem	write	POST	/rest/v1/folders/move
updateAsset	write	PATCH	/rest/v1/assets/{assetId}
updateFolder	write	PATCH	/rest/v1/folders/{folderId}
GetAssetUploadJob	read	GET	/rest/v1/asset-uploads/{jobId}
getAsset	read	GET	/rest/v1/assets/{assetId}
getBrandTemplate	read	GET	/rest/v1/brand-templates/{brandTemplateId}
getBrandTemplateDataset	read	GET	/rest/v1/brand-templates/{brandTemplateId}/dataset
getDesign	read	GET	/rest/v1/designs/{designId}
getDesignAutofillJob	read	GET	/rest/v1/autofills/{jobId}
getDesignExportFormats	read	GET	/rest/v1/designs/{designId}/export-formats
getDesignExportJob	read	GET	/rest/v1/exports/{exportId}
getDesignImportJob	read	GET	/rest/v1/imports/{jobId}
getDesignPages	read	GET	/rest/v1/designs/{designId}/pages
getFolder	read	GET	/rest/v1/folders/{folderId}
getUserCapabilities	read	GET	/rest/v1/users/me/capabilities
getUserProfile	read	GET	/rest/v1/users/me/profile
listBrandTemplates	read	GET	/rest/v1/brand-templates
listDesigns	read	GET	/rest/v1/designs
listFolderItems	read	GET	/rest/v1/folders/{folderId}/items
usersMe	read	GET	/rest/v1/users/me