Access and permissions

Every user of the Canva MCP server authenticates individually, and the operations available to them match their own level of access in Canva. This page covers how your AI application gets access to the Canva MCP server, how it authenticates, what a user's permissions allow, and which capabilities require a paid Canva plan.

Before users can authorize your AI application, Canva needs to recognize its OAuth client. There are two ways to set this up, and which one you use depends on how your AI application authenticates:

• Developer Portal (recommended): Create an app in the Developer Portal⁠(opens in a new tab or window) and turn on Canva MCP. The app's credentials give you a client ID and client secret, and you manage the app's redirect URLs in the Portal, so there's no waitlist. For the steps, follow the Canva for AI assistants path in the Quickstart.
• Waitlist, for CIMD clients: If your AI application authenticates with a Client ID Metadata Document (CIMD) and doesn't use a client secret, apply through the waitlist form⁠(opens in a new tab or window) to have your redirect URI added to the Canva MCP allowlist. Canva reviews each application and contacts you with next steps.

The Canva MCP server authenticates your AI application with OAuth. How your application identifies itself depends on the access path you chose:

• Client ID and client secret: An app created in the Developer Portal identifies itself with the client ID and client secret from its Credentials.
• Client ID Metadata Documents (CIMD): Your OAuth client_id is an HTTPS URL that points to a JSON document describing your client, so there's no client secret to manage. Many popular AI tools already publish a CIMD document and work out of the box.

Canva requires each user to authenticate individually to access the MCP. This also means each user of Canva's tools in your AI assistant will need to have a Canva account. Canva stores and manages designs, assets, and permissions on a per-user basis, not at the organization level.

The operations available to a user match their level of access to a design or asset. For example, editing operations are only available on designs and assets for which you have edit permissions.

Some features require a paid Canva plan:

• All plans: Design generation, editing, search, exports, comments, asset uploads, and most core features
• Canva Pro and above: Design resizing to new dimensions
• Enterprise: Autofill templates with your content, brand kits, and brand templates

• Quickstart
• MCP tools and rate limits
• Verify your Canva MCP app