> ## Documentation Index
> Fetch the complete documentation index at: https://www.canva.dev/docs/extensions/llms.txt
> Use this file to discover all available pages before exploring further.

# GET /apps/configured

API reference for the "/apps/configured" endpoint.

When a user reaches the end of an authentication flow, an app must perform a `302` redirect to the following URL:

```bash
https://www.canva.com/apps/configured
```

This redirect:

* Closes the authentication pop-up window.
* Reloads the app (or displays an error, if the authentication is unsuccessful).
* Protects the app against [cross-site request forgery](https://owasp.org/www-community/attacks/csrf) (CSRF) attacks.

The app must also append the required [query parameters](https://www.canva.dev/#query).

To learn more, refer to [Authentication](https://www.canva.dev/docs/extensions/platform-concepts/authentication/).

**Tip:**
For guidelines on creating a delightful authentication flow, see [Optimizing the authentication flow](https://www.canva.dev/docs/extensions/distribution/ux-guidelines/authentication/).

**Warning:**
If you're creating an app via [canva.cn](https://www.canva.cn), redirect users to the `canva.cn` domain instead of `canva.com`.

## Request

### Endpoint

```bash
GET https://www.canva.com/apps/configured
```

### Query

#### Properties

| Property  | Type    | Required | Description                                                                                                                                                                                                                                                                             |
| --------- | ------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `state`   | string  | Yes      | A token that Canva provides to the app at the start of the authentication flow. The app must return this token to Canva at the end of the authentication flow. This protects the app against [Cross-Site Request Forgery](https://owasp.org/www-community/attacks/csrf) (CSRF) attacks. |
| `success` | boolean | Yes      | If `true`, Canva closes the authentication pop-up window and reloads the app. If `false`, Canva closes the authentication pop-up window and displays an error.                                                                                                                          |

#### Example

```bash
https://www.canva.com/apps/configured?success=true&state=<state>
```