Submission checklist

Once you've developed an app, the next step is to submit it for review. After you submit it, a reviewer from the Canva Apps team will verify that it's suitable for distribution via the Apps Directory⁠(opens in a new tab or window). This page contains a checklist to prepare your app for submission.

Canva's terms and conditions contain essential information about the basic expectations that Canva has for developers and their apps.

At a minimum, read the following pages:

• Terms of Use⁠(opens in a new tab or window)
• Canva Developer Terms⁠(opens in a new tab or window)
• Canva App Terms⁠(opens in a new tab or window)

You're asked to agree to these terms when submitting an app.

Choose a hosting platform that's reliable, secure, and capable of handling the expected traffic.

The tutorials in the documentation use Glitch's free service to demonstrate an extension's capabilities. For production apps, don't use Glitch's free service. The servers are slow and go to sleep after a few minutes of inactivity, which causes timeout errors when opening an app.

If your app integrates with a third-party platform, such as a publish destination, any references to Canva must adhere to Canva's brand guidelines⁠(opens in a new tab or window).

Canva's UX guidelines are packed with advice to create delightful apps. If you want to reduce the amount of time your app spends in the review pipeline, double (and triple) check that it follows the guidelines.

If your app has extensions that receive HTTP requests and has signature verification check enabled, you must verify that any requests it receives are actually arriving from Canva (and not from some nefarious third-party). This requirement is enforced by the signature verification test in the Developer Portal.

If signature verification checks are disabled, there are additional requirements that you must meet before submitting your app.

For more information, refer to Signature verification.

Use reasonable security measures to protect your app and its users.

At a minimum:

• Implement encryption and a strong password policy.
• Sanitize names received from Canva and avoid security issues such as XSS, CSRF attacks, or path traversal. Handle maximum length and unsupported characters suitably.
• Avoid OWASP Top 10⁠(opens in a new tab or window) risks.

Run through the app to ensure it's complete and everything works as expected. This avoids a lot of friction in the review phase and reduces the chances of rejection.

At a minimum, test the:

• Core functionality (ability to show, edit, and publish all supported file types)
• Authentication flow (with and without an active session, with an existing user, with a newly signed up user)
• Endpoints
• Links
• Buttons

Canva will monitor the app's health regularly, and may disable the app if there's a high error rate.

Your app's listing in the Apps Directory⁠(opens in a new tab or window) is an excellent way to drive attention and engagement to your app. Before submitting your app, create copy and graphics that clearly communicate your app's benefits.

For a complete list of guidelines, refer to Creating the App Directory listing.

The copy reflects your app's quality and reputation. Keep the language simple, and free from typos and formatting errors. Proofread the copy, run a spellcheck, and review the grammar and punctuation.

For a complete list of copywriting guidelines, see Writing copy for your app.

If your app supports authentication, the app's reviewer needs to test the authentication flow and any integration points the app has with a third-party platform.

To avoid any delays, prepare the following details before submitting the app:

• Login details for an account that allows the reviewer to test the integration.
• Documentation that introduces the platform:
  • How the platform works.
  • Where's the content sourced from.
  • What are the available tiers (Free, Paid, Pro, etc) and how they'll affect the app users.
  • Where and how can a user access their published designs.
• Documentation that explains where we can find integration points (if any) in the platform.