This endpoint implements the OAuth 2.0 token endpoint, as part of the Authorization Code flow with Proof Key for Code Exchange (PKCE). For more information, see Authentication.

To generate an access token, you must provide one of the following:

• An authorization code
• A refresh token

Generating a token using either an authorization code or a refresh token allows your app to act on behalf of a user. You must first obtain user authorization and get an authorization code.

Access tokens may be up to 4 KB in size, and are only valid for a specified period of time. The expiry time (currently 4 hours) is shown in the endpoint response and is subject to change.

Endpoint authentication

Requests to this endpoint require authentication with your client ID and client secret, using one of the following methods:

• Basic access authentication (Recommended): For basic access authentication, the {credentials} string must be a Base64 encoded value of {client id}:{client secret}.
• Body parameters: Provide your app's credentials using the client_id and client_secret body parameters.

This endpoint can't be called from a user's web-browser client because it uses client authentication with client secrets. Requests must come from your app's backend, otherwise they'll be blocked by Canva's Cross-Origin Resource Sharing (CORS) policy.

Generate an access token using an authorization code

To generate an access token with an authorization code, you must:

• Set grant_type to authorization_code.
• Provide the code_verifier value that you generated when creating the user authorization URL.
• Provide the authorization code you received after the user authorized the app.

Generate an access token using a refresh token

Using the refresh_token value from a previous user token request, you can get a new access token with the same or smaller scope as the previous one, but with a refreshed expiry time. You will also receive a new refresh token that you can use to refresh the access token again.

To refresh an existing access token, you must:

• Set grant_type to refresh_token.
• Provide the refresh_token from a previous token request.

{
  "grant_type": "authorization_code",
  "code_verifier": "i541qdcfkb4htnork0w92lnu43en99ls5a48ittv6udqgiflqon8vusojojakbq4",
  "code": "kp8nnroja7qnx00.opyc1p76rcbyflsxbycjqfp3ub8vzsvltpzwafy9q5l45dn5fxzhe7i7a6mg1i2t8jpsa6sebdeumkzzhicskabgevrxsssec4dvjwfvhq4gs3ugghguar0voiqpfb7axsapiojoter8v3w2s5s3st84jpv2l06h667iw241xngy9c8=vu1tnjp7sz",
  "client_id": "OC-FAB12-AbCdEf",
  "client_secret": "cnvcaAbcdefg12345_hijklm6789",
  "redirect_uri": "https://example.com/process-auth"
}

{
  "access_token": "JagALLazU0i2ld9WW4zTO4kaG0lkvP8Y5sSO206ZwxNF4E1y3xKJKF7TzN17BXTfaNOeY0P88AeRCE6cRF7SJzvf3Sx97rA80sGHtFplFo",
  "refresh_token": "JABix5nolsk9k8n2r0f8nq1gw4zjo40ht6sb4i573wgdzmkwdmiy6muh897hp0bxyab276wtgqkvtob2mg9aidt5d6rcltcbcgs101",
  "token_type": "Bearer",
  "expires_in": 14400,
  "scope": "asset:read design:meta:read design:permission:read folder:read"
}