The verifier caches JWKS public keys according to the configured cache settings. Create one verifier instance and reuse it for all verification requests.

Usage

Basic usage:

import { initDesignTokenVerifier } from '@canva/app-middleware';

// Initialize once at app startup
const designTokenVerifier = initDesignTokenVerifier({
  appId: process.env.CANVA_APP_ID,
});

// Verify tokens per request inside a handler
const payload = await designTokenVerifier.verify(token);
console.log(payload.designId, payload.appId);

TYPESCRIPT

With custom options:

const designTokenVerifier = initDesignTokenVerifier({
  appId: process.env.CANVA_APP_ID,
  cacheMaxAgeMinutes: 30,
  timeoutMs: 10000,
});

TYPESCRIPT

Parameters

optionsTokenVerifierOptions

Required

Configuration options for the verifier

appIdstring

Required

The ID of the Canva app, obtained via the developer portal canva.com/developers.

cacheMaxAgeMinutesnumber

Optional

The maximum age of the JWKS cache in minutes.

Default value: 60

timeoutMsnumber

Optional

The timeout for the JWKS fetch in milliseconds.

Default value: 30000

baseUrlstring

Optional

The base URL for the JWKS endpoint.

Default value: "https://api.canva.com"

Returns

A configured verifier instance.

verifyfunction

Verifies a Canva design JWT token and returns the decoded payload.

Parameters

tokenstring

Required

The JWT token to verify

Returns

The verified design token payload. This is a Promise that resolves with the following object:

appIdstring

The ID of the Canva app

designIdstring

The ID of the Canva design

Throws

When the token is malformed or has an invalid signature

Throws

When the token has expired

Throws

When signing keys cannot be fetched