Agent skill · software engineering · jeremylongshore
canva-reference-architecture
Implement a Canva Connect backend reference architecture with policy, OAuth, job reconciliation, and privacy-safe operations. Use when establishing service boundaries, ownership, storage, and recovery for production. Trigger with: "Canva reference architecture", "design Canva backend", "Canva service layout".
Why this skill is useful
Provides a detailed project structure and best practices for integrating with the Canva Connect API, which the AI wouldn't reliably generate on its own.
What it needs
Requires canva account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Canva Production Reference Architecture Overview Separate browser experience, backend OAuth/policy, provider adapter, durable operation ledger, workers, and controlled data stores. The architecture must prevent cross-tenant access and duplicate mutation by construction. Prerequisites Operations, tenants, traffic, data classes, and recovery objectives Scopes, capabilities, preview dependencies, and public-review posture Secret/token store, operation ledger, queue, observability, and rollback platform Instructions Step 1: Draw trust boundaries Map browser, callback, backend, policy service, token vault, Canva adapter, job ledger, worker queue, data store, telemetry, and provider edges. Step 2: Own authorization centrally Resolve authenticated tenant, application role, resource ownership, explicit scope, capability, feature status, and data purpose before the adapter. Step 3: Own tokens separately Keep client secret and tokens backend-only, encrypt access and refresh tokens separately, serialize per-user refresh, and atomically replace single-use refresh tokens. Step 4: Own mutation identity Create a durable operation record before provider dispatch, attach returned resource/job identity, and reconcile terminal state across retries and restarts. Step 5: Own data lifecycle Store minimum approved metadata/content, authorize every read, expire temporary references, implement consent/account deletion, and keep protected values out of telemetry. Step 6: Own failure recovery Use endpoint-scoped admission, bounded retries, dead letters with reconciliation state, feature flags, immutable deploys, and exercised rollback. Step 7: Record the blueprint Use Write or Edit to document responsibilities, interfaces, schemas, threat decisions, SLOs, failure modes, and verification evidence. Authentication Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/canva-reference-architecture