Overview
Separate provider-contract, credential, application-data, and user-experience migrations. Preserve reversibility and reconcile every asynchronous or mutating operation before moving the next cohort.
Prerequisites
- Source and target operation/capability matrix
- Data inventory, rights, retention, consent, and identifier map
- Cohort plan, feature flag, validation sample, rollback, and owner
Instructions
Step 1: Define parity honestly
Use Read and Grep to map supported, changed, preview, unavailable, and intentionally retired operations. Do not invent workarounds for unsupported provider behavior.
Step 2: Design identity and consent
Keep Canva user/tenant identity separate from legacy IDs, request only explicit scopes, and identify when fresh user authorization is mandatory.
Step 3: Design data movement
Classify assets, designs, metadata, comments, and references; validate rights and format before transfer; avoid copying content that lacks an approved purpose.
Step 4: Build dual-path evidence
Use Write or Edit to add contract tests, operation identity, reconciliation, comparison receipts, and a feature-flagged target path without duplicating writes.
Step 5: Migrate a small cohort
Choose approved synthetic or low-risk users, enforce rate/admission controls, verify each result, and stop on authorization, data, or parity drift.
Step 6: Roll forward or back
Advance only from measured evidence. Roll back routing without losing target-side job/resource identity, then reconcile and clean partial artifacts.
Step 7: Close the legacy path
After the retention and rollback window, revoke unused credentials, delete approved stale data, remove old routes, and preserve a content-free audit receipt.
Authentication
Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.
Tool Discipline
Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.
Output
- Scoped decision or implementation artifact
- Redacted operation and validation receipt
- Failure, rollback, and follow-up ownership record
Examples
A legacy export path is replaced cohort by cohort. The application compares contract outcomes, routes one authorized cohort to Canva, and retains enough opaque identity to roll back and reconcile without double creation.
Error Handling
| Failure | Response |
|---|---|
| Feature parity is missing | Document it and defer or retire the use case |
| Identifier mapping is ambiguous | Stop migration for the affected records |
| Dual path can double-write | Add single authoritative routing and operation identity |
| Rollback loses target jobs | Persist and reconcile them before proceeding |