Canva API (2026): Connect, Apps SDK, Admin, MCP and Which Plan You Need

Canva offers several APIs, and which one you need depends on whether you are building for your own team, for your customers, or for your organisation's administrators. This guide explains the Connect REST APIs, the Apps SDK, autofill, the Admin and SCIM APIs, the MCP connection for AI assistants, and the no-code routes, with the plan each one needs. Everything comes from Canva's help centre and developer documentation at canva.dev, read on 9 October 2026.

The short answer

To create, fill or export Canva designs from your own product, use the Connect REST APIs with OAuth. To add a tool inside the Canva editor, build an app with the Apps SDK. To manage users and teams in a Canva organisation, use the Admin API or SCIM, which need Enterprise, District or Campus. To let an AI assistant work with Canva, use the AI connector. To automate without code, use the official Canva node for n8n ^[57].

## The APIs Canva offers

Canva's help centre lists three API families: the Connect API, to integrate Canva's design capabilities into web apps and platforms; the Admin API, to manage users, teams and groups in a Canva organisation; and the SCIM API, to automate account provisioning and deprovisioning ^[57]. The developer documentation adds the Apps SDK for building inside Canva, a Print API for print partners, audit logs, and the MCP-based "Canva for AI assistants" surface ^{[68] [64]}.

What the Connect REST APIs do

The Connect APIs let another product work with Canva on a user's behalf. Canva's documentation describes the pattern: "you can upload your assets to Canva, programmatically create designs for your users to edit, and then export the finished designs back to your system." ^[64] Typical uses are a CMS that opens a Canva design for an article header, a project tool that attaches designs to tasks, or a print shop that receives finished files. The OpenAPI description is public at canva.dev ^[64].

## Authentication

The REST APIs use OAuth 2.0 with the Authorization Code flow and Proof Key for Code Exchange, using SHA-256 ^[65]. Your app asks the user for the scopes it needs, the user reviews and approves them, and your app exchanges the code for access tokens ^[65]. There is no shared API key for a whole account. Every action happens as a user who has granted access.

Capabilities and plans

What an integration can do depends on the user's plan. Canva's docs call these capabilities: "features or permissions associated with a user's account, and are often tied to a user's Canva plan." ^[66] The help centre's advice is to confirm that your subscription level includes access to the API function you need before you build ^[57]. An integration that works for a Business user may return less for a Free user.

## Autofill with Brand Templates

Autofill fills a Brand Template with your data to produce many designs at once, through the REST API. The developer guide lists autofill and brand templates as available on Canva Pro, including Canva Education and Canva for Nonprofits, on Canva Teams and on Canva Enterprise, and warns: "Usage limits will be introduced in the future." ^[67] Business is not named on that page; given that Business includes everything in Pro ^[7], it should qualify, but confirm with a test account before you build a product on it.

Inside the editor, the same idea is available without code: Data Autofill connects a third-party data source and fills a single brand template with live data, and Bulk Create turns spreadsheet rows into designs ^[95].

Versioning and change management

The REST APIs use date-based versions such as 2024-01-31; superseded versions are expected to stay supported "for at least 6 months" ^[130]. Two warnings matter. Breaking changes to APIs marked Beta or Preview do not produce a new version ^[130]. And "Public apps that use preview APIs or features will not pass the review process" ^[64]. Build production integrations on stable endpoints. Only those. The version in the path, the v1 in api.canva.com/rest/v1, is not the API version ^[130].

## Getting started as a developer

Canva's prerequisites are modest: a Canva account on any plan, Node.js managed through nvm, git, and a current version of Google Chrome, which is the browser Canva actively supports for development ^[132]. You create an app with the Canva CLI, installed from npm as @canva/cli, or by hand in the Developer Portal ^[131]. Canva recommends previewing apps in a standalone browser rather than the desktop app ^[132].

Requests and responses

REST requests go to api.canva.com/rest/v1. Tokens are generated with a POST to the oauth/token endpoint, using form-encoded parameters such as grant_type, code_verifier and code; the authorisation step uses a code challenge with the s256 method ^[134]. Every request after that carries a bearer token for the user who approved access ^[134]. Keep the PKCE verifier on the server side that exchanges the code.

The Apps SDK: building inside Canva

Apps run inside the Canva editor. Canva's quickstart separates two kinds. Public apps are released to everyone after Canva reviews them against a submission checklist, and appear in the Apps Marketplace. Private apps are built for one team, for example to connect an internal system, and are approved by the team's administrators; Private apps are available only to teams on an Enterprise plan ^[131]. To start building, you need a Canva account on any plan ^[132].

Apps for users: connecting third-party tools

For users, apps add tools to the editor from the Apps Marketplace, and connect Canva to services they already use ^[58]. Data connectors bring in CSV or XLSX files, other Canva Sheets, or third-party apps, and keep charts and tables in sync; they are "only available on Canva Business and Canva Enterprise subscriptions" ^[59]. Imported data can be cleaned with Data Actions without changing the source ^[59].

Third-party apps and their terms

Many apps in Canva's marketplace are built and supported by other companies. To use them, users may need to connect the app to their Canva account and accept the developer's own terms and privacy policy; features, permissions and connection steps vary by app and change over time ^[58]. If you deploy apps across a company, review those terms per app, not once for Canva. Admins on team plans can enable or disable apps for their team.

Data connectors in practice

When you import data from apps such as HubSpot or Google Analytics into a presentation or document, Canva creates a chart. To work with raw data in a table, open Canva Sheets and import the data there; Canva notes this is currently the only way to put third-party data into spreadsheet cells ^[59]. Sheets then holds it as a connected data range that can stay in sync. Data connectors need Business or Enterprise ^[59].

The Admin API and SCIM

The Admin API lets an organisation automate management of users, teams and groups from its own systems. It is available to single-team and multi-team organisations on Enterprise, District and Campus plans; only organisation admins can create Admin API clients, and the admin must have multi-factor authentication or an SSO-managed account ^[63]. Actions are recorded against the API client, not the person who ran it ^[63]. If your team cannot build against an API, Canva suggests SCIM provisioning instead ^[63]. The Admin API also uses date-based versions with a support window, for example six months ^[133].

Canva for AI assistants: the MCP connection

Canva connects to AI assistants such as Claude and ChatGPT through its AI connector, which uses the Model Context Protocol ^{[61] [62]}. Once connected, a user can create or generate designs, search existing work, get presenter notes, copy or merge designs, autofill templates and export files from the chat ^[60]. Some actions need a paid plan, and a user only sees Brand Templates a team admin or Brand Designer has shared ^[60]. For developers, a separate Dev MCP server gives AI coding tools such as Cursor or Claude Desktop access to Canva's developer documentation and tools while building apps ^[69].

What the AI connector can do

From a connected assistant, users can create or generate designs, search their designs, get a design's details and shareable links from its ID, get presenter notes, copy or merge designs, autofill Brand Templates with data, and export files ^[60]. Some of those actions are "available on paid Canva plans, including Canva Education" ^[60]. Users see only the Brand Templates an admin or Brand Designer has shared with them, and if an admin has switched Magic Design off, nobody in the team can generate designs through the assistant ^[60]. The connector works in ChatGPT on every Canva plan, including Free ^[62].

The Dev MCP server

For developers, Canva runs a separate Dev MCP server that gives AI coding tools access to Canva's developer documentation and tools while building apps. It works with MCP clients such as Cursor and Claude Desktop, and its tools are available only in an agent mode ^[69]. It is a development aid. Not a production API.

The Print API

Canva also has an API for print partners. The Print API automates communication between Canva and print partners in Canva's fulfilment network to create and manage print orders placed by Canva users; a partner must be part of that network to use it . It uses date-based versions like the other APIs . It is not a way for a business to print its own designs programmatically.

No-code automation: the n8n node

For automation without writing HTTP requests, Canva publishes an official node for n8n. The help centre says: "This Canva-owned node supports all Connect API actions" ^[57]. You can install it from npm for a local n8n, or find the verified Canva node in n8n's node panel ^[57]. That makes it the shortest path to, for example, generating social images from a spreadsheet on a schedule.

A worked example: fifty event posters

A team needs fifty posters, one per speaker, from a spreadsheet of names, titles and photos. Three routes, in order of effort.

• No code. Put the data in Canva Sheets or a CSV and use Bulk Create to fill one template; Data Autofill can also pull from apps such as Google Analytics or HubSpot ^[95]. Fastest for a one-off. No code at all.
• Low code. Use the official n8n node to call the Connect API's autofill on a schedule, for example when a row is added ^[57]. Good for a recurring event. Little code.
• Full integration. Call the autofill endpoint from your own product with OAuth on behalf of each organiser; the guide lists autofill on Pro and above and warns of future usage limits ^[67]. Right for a platform that serves many customers.

Choosing the right route

Goal	Route	Plan needed
Create and export designs from your product	Connect REST APIs	User's plan decides capabilities
Fill templates with data	Autofill API or Data Autofill	Pro and above, per the docs
Add a tool inside Canva for everyone	Public app, Apps SDK	Any plan to build; Canva review
Add a tool for your company only	Private app, Apps SDK	Enterprise
Manage users and teams	Admin API or SCIM	Enterprise, District, Campus
Let an AI assistant use Canva	AI connector (MCP)	Any; some actions paid
Automate without code	n8n Canva node	Per Connect API action

Sources for the table: the help centre and developer docs cited above.

Data and security considerations

Because the REST APIs act as the user, your integration inherits the user's permissions and plan. Organisations with data-location requirements should note that data residency, choosing US or EU storage, is available only on Enterprise, Campus and District plans ^[71], and that SSO with SAML is an Enterprise setup ^[70]. If your integration uploads customer files into Canva, tell users that Canva's privacy policy allows content to be used for AI training unless they switch it off ^[47].

Limits to plan around

Canva's public pages we read do not publish rate limits for the Connect APIs, and the autofill guide says usage limits will be introduced later ^[67]. Design around that: queue requests, retry with back-off, and avoid an architecture whose cost depends on unlimited autofill. Check the changelog when a new date version ships ^[64].

## Our read

Canva's developer surface is broader than most design tools offer: OAuth-based REST APIs for embedding Canva in a product, an apps platform inside the editor, admin and provisioning APIs for large organisations, and an MCP connection that puts Canva inside AI assistants. The gating is by plan and by stability. Build on stable versioned endpoints, check the plan behind each capability, and treat Enterprise as the entry point for anything that manages users or stays private to your company.