
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@canva/cli
Advanced tools
CLI for creating and managing Canva Apps.
@canva/cli is a command line tool designed for creating and managing Canva Apps. Use @canva/cli to get started creating and testing your app. The Canva CLI allows you to create apps from the command line, and to use Canva's recommended development tools and templates.
To learn more about app development, visit the official documentation.
Before using the CLI, make sure that you have the following:
Node.js v24
npm v11
Note: If you are using a version manager such as nvm, run the nvm install 24 command to make sure you have the correct Node.js version.
The following commands create a new Canva app using the Canva CLI.
npm install -g @canva/cli@latest
canva login
canva apps create "My New App" --template="hello_world" --distribution="public" --git --installDependencies
cd my-new-app
npm start
Installing the Canva CLI allows you to create new apps from the command line.
To get started:
Install the Canva CLI globally.
npm install -g @canva/cli@latest
Log in to the Canva CLI. The Canva CLI then opens an access request page in your browser.
canva login
In your browser, click Allow to grant the Canva CLI access to create and edit apps on your behalf. When you grant access, the Canva CLI generates an auth token and stores it locally. For more information on the auth token, read the following section on auth token storage and removal.
Copy the confirmation code shown in your browser, and paste it into the Canva CLI input.
After you log in to the Canva CLI and authorize it, you can create your app.
To create a new app:
Run the canva apps create command. The flags in the following code snippet are optional, and you can instead configure these settings during the apps creation process. See the CLI Reference for more information on each flag.
canva apps create "My New App" --template="hello_world" --distribution="public" --git --installDependencies
Note: You can't change the distribution type after creating an app.
When your new app is ready, the Canva CLI automatically opens the Developer Portal to your new app's configuration page in your browser. You can then continue to preview and manage your new app.
To preview your app:
Change into your new app's folder.
cd my-new-app
Run the following command to start your app.
npm start
The preview URL will be generated and opened automatically in your browser.
If this is the first time previewing your app, click Open to preview your new app.
After creating your app, you can diagnose potential issues using:
canva apps doctor
This checks for missing dependencies, outdated packages, and other issues.
When you log in to the Canva CLI using the canva login command, and then grant the Canva CLI access to manage apps in your Canva account, an auth token is encrypted and stored locally on your machine. The token provides authentication for future requests so you don't need to grant the Canva CLI access each time it sends a request.
When you log out of the Canva CLI with the canva logout command, the auth token is revoked, and deleted.
The auth token is located in your home directory under the .canva-cli folder.
To delete the token, there are two options. However, only the canva logout command revokes and deletes the token. If there's a copy of the token, it's possible to reconnect the Canva CLI to your account's apps using the token.
Use the canva logout command to revoke access and delete the stored token.
canva logout
Locate the credentials file, which is stored in the following locations:
~/.canva-cli/credentials.%USERPROFILE%\.canva-cli\credentials.Delete the file.
After installation, you can use the Canva CLI by running:
canva <command-name>
Top-level flags applicable to commands:
--help: Show help information about commands and flags.--lite: Enable a simplified CLI interface for enhanced accessibility.--version: Show the CLI version number.Show the welcome page and general information.
canva welcome
Print a random development tip for working with the Apps SDK.
canva tip
tips: Also prints a random development tip.Raise an issue with the Canva CLI on GitHub.
canva bug
Log in to the Canva CLI.
canva login
--china, --cn: Login to canva.cn, this will use canva.cn for all subsequent commands until you log out.
--mode: The authentication mode or flow to use when logging in.
Available modes:
"callback": Runs a local server to receive the auth code (default)."manual": Prompts you to copy and paste the auth code manually.Log out of the Canva CLI, and delete the saved auth token:
canva logout
Start the canva MCP server. This is usually called by your MCP client, such as Claude Desktop, Cursor, or other compatible tools. For more information on how to configure your MCP client to use the Canva MCP server, please see MCP Server in the developer documentation.
Manage your Canva apps.
canva apps
Create a new Canva app.
canva apps create "My New App" --template="hello_world" --distribution="public" --git --installDependencies
--name: Sets the app's name. Provide the name you want for the app.--template: Specifies the starting template for the app. Templates are pre-built starter projects that demonstrate common use cases and best practices. For a complete list of available templates, see App templates.
--distribution: Sets the app's distribution type.
Available types:
"public": Available to all Canva users, subject to Canva review.
"private": Only available to your team on an Enterprise plan, and requires team admin approval.
Note: You can't change the distribution setting after creating a new app with the canva apps create command.
--git: Initializes a Git repository in the project directory.
--installDependencies: Automatically installs necessary npm dependencies during the app creation process.
--optionalConfig: Optional configuration files to be created in the project directory.
Available options:
"vscode": Adds a .vscode folder to the project directory."cursor": Adds a .cursor folder to the project directory."agents.md": Adds a AGENTS.md file to the project directory."claude": Adds a CLAUDE.md file to the project directory.--offline: Scaffold the app locally without also creating an app in the Developer Portal.
--yes: Answer yes, or use the default, for all questions during app creation.
List all Canva apps.
canva apps list
--appId: Specifies an App ID to select.--all, -a: Lists all apps at once without pagination.--print, -p: Prints the list of apps to the console without interactivity.Preview your app.
canva apps preview
Run diagnostics on your Canva App to identify and fix issues.
canva apps doctor
--ci: Run in CI mode (overrides all other flags: enables --report, --silenceUpdates, disables --fix, --verbose, skips environment checks).--fix: Automatically apply fixes for issues where possible.--report: Output check results without prompting for fixes.--verbose: Show detailed diagnostic output optimized for AI agent assistance.--check: Specify a specific check to run.Run specific code migrations to update your app to newer patterns and APIs.
canva apps migrate <migrationName>
Arguments:
migrationName: Name of the migration to run.
Available migrations:
"apps-sdk-v1-v2": Migrates apps using the Apps SDK v1 packages to v2."app-ui-kit-v5": Migrates apps using App UI Kit v4 to v5."design-editor-intent": Migrates from direct render pattern to design intents pattern.Examples:
canva apps migrate apps-sdk-v1-v2
canva apps migrate app-ui-kit-v5
canva apps migrate design-editor-intent
canva apps migrate apps-sdk-v1-v2 --debug
Manage your App Configuration.
canva apps config
Fetch the canva-app.json config from the Developer Portal.
canva apps config pull
--force: Automatically pull config regardless of conflicts.--strategy: Choose the resolution option for config conflicts - local, remote or manualSubmit the local canva-app.json to the Developer Portal.
canva apps config push
--force: Automatically push config regardless of conflicts.--strategy: Choose the resolution option for config conflicts - local, remote or manualReport on the status and validity of the canva-app.json config.
canva apps config status
Link your local project to an existing Canva app by updating the .env file
canva apps link
--appId: Specifies an App ID to select.Log out and revoke Canva CLI access.
canva logout
You must manage your new app created through the Canva CLI through the Developer Portal. You can't manage apps completely through the Canva CLI.
To update the CLI to the latest version, run:
npm update -g @canva/cli@latest
Currently the Canva CLI doesn't accept third-party contributions. Please submit any feature requests through the Canva Developers Community or raise an issue on Github.
Refer to the LICENSE.md file for more information.
FAQs
The official Canva CLI.
The npm package @canva/cli receives a total of 6,133 weekly downloads. As such, @canva/cli popularity was classified as popular.
We found that @canva/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.