Overview
Change one controlled variable at a time and compare logical-operation outcomes, not just raw request latency. Never cache credentials or assume fixed Canva URL lifetimes and performance guarantees.
Prerequisites
- Baseline window, normalized endpoint, workload, and local SLO
- Current OpenAPI/response contract and endpoint rate metadata
- Cache data class, freshness/invalidation policy, feature flag, and rollback
Instructions
Step 1: Establish a baseline
Use Read and Grep to measure logical operations, provider calls, latency distribution, job completion, retries, cache hits, errors, and queue depth with synthetic or approved data.
Step 2: Identify the bottleneck
Separate network/connection latency, unnecessary fields, pagination, duplicate reads, write retries, polling cadence, token locks, worker capacity, and local storage.
Step 3: Design one experiment
Use Write or Edit to change one cache, pagination, connection, queue, or poll control behind a feature flag with explicit success and rollback thresholds.
Step 4: Protect caches
Cache only approved metadata, key by authorization boundary, encrypt where policy requires, and invalidate on writes, consent/ownership changes, or freshness expiry.
Step 5: Tune asynchronous polling
Persist job ID, begin with a short local interval, apply bounded exponential backoff, and stop at the application budget while reconciliation continues asynchronously.
Step 6: Validate and roll out
Compare correctness, freshness, duplicate prevention, resource use, and latency. Roll back on stale authorization, missed completion, increased errors, or throttling.
Authentication
Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.
Tool Discipline
Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.
Output
- Scoped decision or implementation artifact
- Redacted operation and validation receipt
- Failure, rollback, and follow-up ownership record
Examples
A service reduces design-list calls with a tenant- and user-authorized metadata cache. The experiment proves freshness and invalidation before rollout and never stores thumbnail or export URLs durably.
Error Handling
| Failure | Response |
|---|---|
| No baseline exists | Instrument before optimizing |
| Cache serves stale authorization | Disable it and fix ownership/consent invalidation |
| Polling increases 429s | Lower scoped concurrency and widen bounded intervals |
| Latency improves but correctness regresses | Roll back the experiment |