At Canva, the privacy of our users is a top priority, but there are many valid reasons for apps to have access to their data. To balance these concerns, the Apps SDK has a permissions system that lets developers access user data while ensuring that users remain informed and in control of what data is accessed.

How permissions work

In the Apps SDK, some methods have an associated permission. If an app uses one of these methods, the permission must be enabled via the Developer Portal. If the permission is not enabled, the app cannot be approved for release.

By requiring apps to enable permissions, Canva can inform users of what data the app will have access to — and what the app can do with that data — before the user installs it.

The user experience

Before a user installs an app, they're shown a screen that explains what the app is and what permissions are required to install it. If an app doesn't require any permissions, no requirements are listed.

If the user doesn't accept the app's permissions, the app can't be installed.

If a user uninstalls an app, all permissions are revoked.

What permissions are required?

The permissions required by an app depend on the methods called by the app. For the complete list of permissions, along with the methods associated with those permissions, see List of permissions.

How to configure permissions

Navigate to an app via the Your apps page.
Under the App permissions heading, enable the required permissions.

List of permissions

This section lists the permissions that can be enabled for an app, including the methods that require the permission to be enabled. The required permissions are also listed on the API reference pages for each method.

`canva:design:content:read`

The app may read the content of the user's design.

The following methods require this permission to be enabled:

getCurrentPageContext
initAppElement, if the app calls the registerOnElementChange method
selection.registerOnChange, if the app calls the read method

`canva:design:content:write`

The app may modify the content of the user's design.

The following methods require this permission to be enabled:

addAudioTrack
addElementAtCursor
addElementAtPoint
addNativeElement
addPage
initAppElement, if the app calls the addOrUpdateElement method
selection.registerOnChange, if the app calls the save method

`canva:asset:private:read`

The app may download assets from the user's media library.

The following methods require this permission to be enabled:

getTemporaryUrl

`canva:asset:private:write`

The app may upload assets to the user's media library.

The following methods require this permission to be enabled:

upload