Provider REST API

21 actions

Connect Claude to Canva

Find, create and export Canva designs, and work with folders, assets, brand templates and comments. Toolspoke puts 21 of its actions behind one MCP endpoint that Claude, Cursor, and Codex all speak.

Connect View pricing

Connection: Provider REST API
Authentication: Sign in with Canva
Actions exposed: 21
What a call bills: Nothing
Adapter: Maintained by Toolspoke

Connected in three steps

1
Install Canva
Open the marketplace in your workspace, add Canva to the project your agents work in, and it appears on the gateway immediately.
2
Connect the credential
Sign in to Canva. Toolspoke holds the token encrypted and refreshes it when it expires.
3
Point your agent at the gateway
Give your client one address, https://toolspoke.com/mcp. Claude Code takes it as a command, Claude and Claude Desktop add it as a custom connector, and Cursor, Codex and VS Code each read it from a config file of their own.

.mcp.json

{
  "mcpServers": {
    "toolspoke": {
      "type": "http",
      "url": "https://toolspoke.com/mcp"
    }
  }
}

One block covers every tool you have installed. Canva shows up in the client as soon as your policy allows it, and so does everything else you install later.

Where the address goes, per client

Claude Code: Run it in your project, then /mcp to sign in
claude mcp add --transport http toolspoke https://toolspoke.com/mcp
Claude and Claude Desktop: Settings, then Connectors, then Add custom connector
https://toolspoke.com/mcp
Cursor: ~/.cursor/mcp.json, or .cursor/mcp.json for one project
{ "mcpServers": { "toolspoke": { "url": "https://toolspoke.com/mcp" } } }
Codex: ~/.codex/config.toml
[mcp_servers.toolspoke] url = "https://toolspoke.com/mcp"
VS Code: .vscode/mcp.json, or the MCP: Add Server command
{ "servers": { "toolspoke": { "type": "http", "url": "https://toolspoke.com/mcp" } } }

What Canva asks for

Press connect and sign in to Canva. Toolspoke keeps the token encrypted and refreshes it when it expires, so there is nothing to copy and nothing to rotate by hand.

The scopes it asks for

profile:read
design:meta:read
design:content:read
design:content:write
folder:read
folder:write
asset:read
asset:write
brandtemplate:meta:read
brandtemplate:content:read
comment:read
comment:write

What Claude can do in Canva

21 actions, each one declared and named by the connector rather than discovered at runtime. A workspace policy grants a person all of them, a hand-picked selection, everything on the read side, everything on the write side, or none.

Reads: 14Reads
Writes: 6Writes
Destructive: 1Destructive

Reads

Fetches data and changes nothing.

get_user
Return the user ID and team ID of the signed-in Canva account.
get_user_profile
Return the display name of the signed-in Canva account.
list_designs
List the designs in the user's Canva projects, with each design's ID, title, owner, edit and view URLs, thumbnail and timestamps. Filter with `query`, limit to designs the user owns or that were shared with them with `ownership`, and sort with `sort_by`. Results come in pages; pass the returned `continuation` to get the next page.
get_design
Return the metadata of one design, including its owner, edit and view URLs, thumbnail and page count.
get_export_formats
List the file formats one design can be exported to (for example pdf, png, jpg, pptx, mp4). Check this before create_export.
get_export
Return the status of an export job (in_progress, success or failed) and, once it succeeds, the download URLs of the exported files. The URLs are valid for 24 hours.
get_folder
Return the name, thumbnail and timestamps of one folder.
list_folder_items
List the items in a folder: designs, folders, images and, if asked for, brand templates. Use the folder ID `root` for the top level of the user's projects, or `uploads` for their Uploads folder. Results come in pages; pass the returned `continuation` to get the next page.
get_asset
Return the metadata of one uploaded asset (image or video), including its name, tags, owner and thumbnail.
list_brand_templates
List the brand templates the user can access. Needs a Canva plan with brand templates (Pro, Teams or Enterprise). Set `dataset` to non_empty for templates that have autofill data fields. Results come in pages; pass the returned `continuation` to get the next page.
get_brand_template
Return the metadata of one brand template, including its title, view and create URLs, and thumbnail.
get_brand_template_dataset
Return the autofill data fields of a brand template, with each field's name and type (text, image or chart).
get_comment_thread
Return one comment thread on a design, with its message, author, assignee and resolution state. Canva preview API.
list_comment_replies
List the replies in a comment thread on a design. Results come in pages; pass the returned `continuation` to get the next page. Canva preview API.

Writes

Creates or updates something on the other side.

create_design
Create a new, empty Canva design and return it with its edit URL. Give `design_type` as a preset, for example {"type": "preset", "name": "presentation"} (doc, email, presentation or whiteboard), or as a custom size, for example {"type": "custom", "width": 1080, "height": 1080} (each side 40-8000 px). You can also pass `asset_id` to put an image asset into the design. At least one of `design_type` or `asset_id` is required.
create_export
Start a job that exports a design to a file, and return the job with its ID. `format` takes a `type` (pdf, jpg, png, pptx, gif, mp4, html_bundle, html_standalone or csv) and that format's options, for example {"type": "pdf", "size": "a4"} or {"type": "png", "width": 1080, "pages": [1]}. Poll get_export with the job ID for the result. The download URLs it produces work for anyone who has them, for 24 hours.
create_folder
Create a folder and return it with its ID. Use the parent folder ID `root` for the top level of the user's projects, or `uploads` for their Uploads folder.
update_asset
Rename an asset, replace its tags, or both. `tags` replaces all existing tags; leave it out to keep them.
create_comment_thread
Add a comment to a design, and return the new thread with its ID. Collaborators on the design see it. Mention a user as [user_id:team_id]; to assign the comment, also set `assignee_id` and mention that user. Canva preview API.
create_comment_reply
Reply to a comment thread on a design. Collaborators on the design see it. Mention a user as [user_id:team_id]. Canva preview API.

Destructive

Deletes or permanently alters something. Worth granting on purpose.

delete_asset
Delete an asset. Canva moves it to the trash; designs that already use it keep it.

What it will not do

Enforced by the gateway rather than left to convention, which is why each of these can be stated flatly.

It cannot call anything else: The 21 actions above are the whole of it. A call to any other name is refused before it reaches Canva rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time.
It reaches no further than your credential: Toolspoke holds no access to Canva of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either.
It never hears from Canva: Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Canva. An agent has to ask.
It does not smooth over provider limits: Toolspoke does not retry, queue or back off around Canva's own rate limits. A call that Canva refuses comes back to the agent as a failed call.

Before you connect it

What can Claude do in Canva?

21 named actions: 14 that only read, 6 that write and 1 that delete or permanently alter something. They include get_user, get_user_profile and list_designs. Nothing outside that list is reachable: the connector declares each operation by name rather than proxying whatever an agent asks for.

What credentials does the Canva connector need?

Nothing to paste. You sign in to Canva over OAuth 2.0 and Toolspoke keeps the resulting token encrypted, refreshing it when it expires. It asks for profile:read, design:meta:read, design:content:read, design:content:write, folder:read, folder:write, asset:read, asset:write, brandtemplate:meta:read, brandtemplate:content:read, comment:read and comment:write, and can do nothing outside them.

Does the Canva connector work with Cursor and Codex, or only Claude?

Any client that speaks MCP, and every one of them gets the same 21 actions. There is a single address, https://toolspoke.com/mcp. Claude Code adds it with claude mcp add --transport http, Claude and Claude Desktop take it as a custom connector in settings, Cursor reads it from .cursor/mcp.json, Codex from ~/.codex/config.toml, and VS Code from .vscode/mcp.json. Each of them signs in to the gateway itself, so there is no key to paste.

What does the Canva connector not do?

The 21 actions above are the whole of it. A call to any other name is refused before it reaches Canva rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time. Toolspoke holds no access to Canva of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either. Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Canva. An agent has to ask. Toolspoke does not retry, queue or back off around Canva's own rate limits. A call that Canva refuses comes back to the agent as a failed call.

Can I limit which actions an agent can call?

Yes, in two places. The project switches Canva's actions on and off one at a time, for everyone in the project at once, and the screen groups them by read, write and destructive so turning off everything that deletes is one click. An individual agent key can then be narrowed further, to particular toolkits in a project and to particular actions in a toolkit. Whatever it was granted, a key never reaches a project its owner cannot.

What gets recorded when an agent calls Canva?

Every attempt, with the agent that made it and the person that agent belongs to, the full request payload, the response payload, the status, the duration, and what the call cost in sandbox time and model tokens. Values whose key names a secret are masked out before the record is shown to anyone. An operation the connector marks as not retained never has its response body written at all, so the gateway keeps no second copy of what was read.

More design connectors

Browse all of them