Agent skill · software engineering · jeremylongshore
canva-multi-env-setup
Configure isolated development, staging, and production Canva integrations. Use when separating redirect URIs, credentials, users, token stores, scopes, data, and audit evidence across environments. Trigger with: "Canva environments", "Canva staging setup", "separate Canva credentials".
Why this skill is useful
Provides specific configuration patterns and OAuth management for Canva across multiple environments that the AI wouldn't reliably generate on its own.
What it needs
Requires aws, gcloud, vault installed locally. Requires canva account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Canva Environment Isolation Overview Give each environment an independent Canva integration and trust boundary. Prevent a staging build, callback, credential, user, or token record from resolving to production. Prerequisites Named environments, owners, domains, and deployment identities Separate Developer Portal integrations and redirect URIs Secret backend, token namespace, test-user, data, and audit policy per environment Instructions Step 1: Build the matrix Use Read and Grep to map environment to integration ID, exact redirect hosts, scopes, preview features, secret references, token/data namespace, and owners. Step 2: Separate integrations Create or verify distinct Canva integrations where isolation is required. Never distinguish environments only with a runtime variable while sharing credentials. Step 3: Constrain configuration Use Write or Edit to validate environment identity, controlled host allowlists, exact callback routes, expected integration ID, and forbidden cross-environment values at startup. Step 4: Isolate secrets and tokens Use separate secret paths, encryption keys where policy requires, access policies, token tables or namespaces, backup rules, and rotation owners. Step 5: Isolate users and data Use synthetic development/staging users and assets. Prevent non-production workers, webhooks, or support tooling from reading production records. Step 6: Test negative boundaries Prove staging cannot use production client secrets, callbacks, tokens, queues, databases, or webhook routes; fail closed on mismatch. Step 7: Record promotion rules Document which artifact is shared, which configuration must differ, rollback, environment cleanup, and evidence needed before production. Authentication Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/canva-multi-env-setup