Agent skill · software engineering · jeremylongshore
canva-local-dev-loop
Configure local Canva Connect development with contract fixtures and an optional dedicated OAuth integration. Use when building adapters, callbacks, async-job handling, or UI flows without using production credentials. Trigger with: "Canva local setup", "mock Canva API", "test Canva callback locally".
Why this skill is useful
Provides a detailed setup for local development with Canva's API, including OAuth flows and mock server configurations that the AI wouldn't reliably generate on its own.
What it needs
Requires ngrok, node installed locally. Requires canva account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Canva Mock-First Local Loop Overview Make the default loop offline, deterministic, and safe. A live development check is exceptional and must not reuse production integrations, tokens, assets, or redirect configuration. Prerequisites Existing project, package manager, and test framework Pinned OpenAPI/fixture version and adapter boundary Dedicated development integration and synthetic-user policy if live mode is approved Instructions Step 1: Inventory the project Use Read and Grep to locate HTTP adapters, OAuth callback/state handling, fixtures, environment loading, token persistence, async job polling, and ignored files. Step 2: Create contract fixtures Use Write or Edit to model identity, designs, exports, assets, autofill, errors, throttling, and unknown fields at the transport boundary. Step 3: Keep credentials out by default Make tests fail if production-looking secrets are loaded. Never save tokens in a plaintext project file, browser storage, snapshot, or console. Step 4: Test callback state Exercise success, denial, state mismatch, expired/replayed callback, missing verifier, token-exchange failure, and atomic refresh replacement without real secrets. Step 5: Test async reconciliation Use deterministic clocks to cover in-progress, success, failed, timeout, retry, restart, and duplicate-delivery behavior. Step 6: Run one approved live read If required, use a dedicated development integration and test user for a non-mutating request, then delete ephemeral credentials and evidence under policy. Step 7: Close production drift Document every development redirect URI and remove localhost, loopback, and tunnel hosts before production review. Authentication Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/canva-local-dev-loop