Canva Connect API Authentication : Step-by-Step Setup Guide

Key Takeaways

By the end of this lesson, you will understand:

• What Canva Connect API authentication is and why you need it
• What Client ID, Client Secret, Redirect URL, Authorization Code, Access Token, and Scopes mean
• How to configure authentication for your Canva integration
• How to choose the permissions your integration needs
• How the authentication process allows your application to securely connect to Canva

What is Canva Connect API authentication?

Canva Connect API authentication is the security process that allows an outside application to connect to your Canva account safely.

Think of your Canva account as your private house and the outside application as a helper you hired to perform specific tasks.

You don’t want to give the helper unlimited access to your entire house. Instead, you give the helper the appropriate credentials and permission to enter only the areas needed for the job.

That’s essentially what authentication and permission scopes do for your Canva integration.

Step 1: Open Your Canva Integration

Once your Canva integration has been created, open it from the Your apps area of the Canva Developer Portal.

The integration dashboard is where you configure how your external application will connect to Canva.

The Outside Canva section contains the settings used when an external application communicates with Canva. You can see that Canva REST APIs are enabled, along with the areas for configuring your integration. Click on button labeled, “Configure.”

This is the starting point for configuring the connection between your application and Canva.

Before your Google Apps Script or other application can communicate with Canva, you need to configure the authentication and permissions for this integration.

Step 2: Find Your Client ID and Generate a Client Secret

Go to Outside Canva → Configuration.

Here you will find your Client ID and the option to Generate secret. It is a random collection of letters and numbers. It is an identifier for computer programs know the specific Canva app integration.

What is the Client ID?

The Client ID is the public identifier for your integration.

It tells Canva:

“This is the application asking to connect.”

What is the Client Secret?

The Client Secret is a confidential credential associated with your integration.

Think of the Client ID as your application’s ID badge and the Client Secret as its hidden password.

Keep the Client Secret secure and do not expose it in public code, screenshots, or repositories.

Your application needs these credentials as part of the authentication process.

Step 3: Configure the Authentication URL

Your application needs to send the user through Canva’s authorization process.

The authentication URL is the URL your application uses to start that process.

When the user follows the authentication link, Canva can identify your integration, show the requested permissions, and ask the user to authorize access.

Your application should not simply try to access a Canva account on its own.

The user needs to go through Canva’s authorization flow and explicitly grant the requested access.

This is an important part of keeping the connection secure.

Next, configure the Redirect URL for your integration.

The Redirect URL tells Canva where to send the user after they complete the authorization step.

Think of it as the return address for the authentication process.

For example:

Your application → Canva authorization → User approves → Canva redirects back to your application

Without a correctly configured redirect URL, your application does not have a defined destination for the next part of the authentication flow.

Canva’s configuration screen requires at least one redirect URL for the authentication flow.

Step 4: Choose Your Permission Scopes

Now we get to one of the most important parts of the configuration: Scopes.

Canva Connect API scopes explained in detail for beginners.

Scopes define what your application is allowed to access or do through the Canva Connect API. For example, the configuration screen shows scopes related to areas such as:

• App
• Assets
• Brand templates
• Collaboration events

Some scopes can have Read and Write permissions. Your application should request only the permissions it actually needs.

Think of scopes as giving your helper access to specific rooms in your house. If your automation only needs to work with assets, it does not need permission for unrelated functionality.

Requesting the appropriate scopes also makes it easier to explain what your integration needs access to.

Step 5 : User Authorization and the Authorization Code

Once your authentication request is configured, the user goes through Canva’s authorization screen.

The user reviews the requested permissions and selects Approve.

Canva then provides an Authorization Code as part of the OAuth authentication flow.

What is an Authorization Code?

An Authorization Code is a temporary value used by your application to continue the authentication process.

It is not the same thing as the final Access Token.

Think of it like a temporary claim ticket. Your application uses it as the next step in obtaining the credentials it needs to make authenticated API requests.

Understand the Four Pieces You Are Configuring

Before continuing, it helps to understand the main pieces involved in authentication.

Your Canva integration uses several pieces of information to establish a secure connection:

• Client ID — identifies your application
• Client Secret — confidential credential associated with your application
• Scopes — define what your application is requesting permission to do
• Redirect URL — tells Canva where to send the user after authentication

These pieces work together as part of the authentication process.

Putting It All Together

The complete authentication process can be thought of as a sequence:

1. Create your integration
2. Get your Client ID and Client Secret
3. Configure your Redirect URL
4. Choose the required permission scopes
5. Send the user to Canva’s authorization page
6. User approves the requested permissions
7. Canva returns an Authorization Code
8. Your application continues the authentication process

Once authentication is configured correctly, your application has the foundation it needs to make authorized requests to the Canva Connect API.

What’s next?

Now that you understand the authentication pieces, the next step is to connect this process to your automation.

In the next lesson, we’ll use Google Apps Script to work with the Canva Connect API and begin turning this authentication setup into a working Canva automation.

Understand the Authentication Terms

At this point, you may see several technical terms in Canva’s documentation.

Here is a simple translation:

Technical term	Simple explanation
Client ID	Your application’s ID
Client Secret	Your application’s confidential credential or password
Scopes	The permissions your application requests
PKCE	Part of the security process used during authorization
Authorization Code	A temporary code returned after authorization
Access Token	The credential your application uses to make authorized API requests
Refresh Token	A credential used to obtain a new access token when appropriate

You don’t need to memorize all of these terms before continuing.

The important idea is that authentication establishes who the application is, what it is requesting permission to do, and how Canva can securely return the authorization result to the application.