Agent skill · software engineering · jeremylongshore
canva-architecture-variants
Choose a Canva Connect integration architecture from explicit trust, workload, and recovery constraints. Use when deciding between a backend monolith, service plus workers, or isolated multi-tenant services. Trigger with: "design Canva architecture", "scale Canva integration", "choose Canva topology".
Why this skill is useful
Provides detailed architectural patterns and code examples for integrating with the Canva Connect API that the AI wouldn't reliably generate on its own.
What it needs
Requires canva account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Canva Architecture Decision Overview Select the smallest topology that preserves backend OAuth, per-user token isolation, asynchronous job reconciliation, and policy-controlled data handling. Treat scale thresholds as measured local evidence, not Canva product limits. Prerequisites Expected operations, traffic shape, tenants, and recovery objectives Data classification, retention policy, and secret backend Current scopes, capabilities, preview dependencies, and deployment constraints Instructions Step 1: Map trust boundaries Identify browser, backend, token store, job ledger, worker, data store, and Canva API boundaries. Mark every place customer content or credentials could cross. Step 2: Choose the base shape Use a backend monolith for one bounded service, a service plus worker when asynchronous jobs must outlive requests, or isolated services only when ownership and failure domains justify them. Step 3: Design token rotation Serialize refresh per Canva user, atomically replace the single-use refresh token, and separate access-token and refresh-token storage. Step 4: Design job reconciliation Persist opaque job identity before dispatch, poll with bounded backoff, and reconcile terminal state before repeating a mutating operation. Step 5: Design policy enforcement Resolve tenant, resource, explicit scope, capability, preview status, and data policy before dispatch rather than inside a generic HTTP client. Step 6: Record the decision Use Write or Edit to capture selected shape, rejected alternatives, assumptions, failure modes, rollback, and validation evidence. Authentication Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically. Tool Discipline Use Read and Grep for discovery and evidence. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/canva-architecture-variants