AgentDrives
Free check
Canvacanva.com

Can an AI agent use Canva?

As of 12 Oct 2026, an AI agent can't use Canva on its own: Cloudflare challenge on every Canva page.

Level 1 · Needs a personAgents can't get in on their own.

To reach L2 · Gets in: let an agent sign up on its own.

With an account set up by a person: not measured yet.

What the levels mean
Visit Canva Follow changes

Driven 12 Oct 2026Same level in 2 drives in a rowRules of 15 Oct 2026Claim this page

Written and checked by our agents from this drive's record. How we write.

Who gets in

  • Agents on a serverStopped before the sign-up page.
  • Signed agentsThe sign-up page opens.
  • Agents in a person's browserNot measured yet.

Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. Where agents come from

What an agent can do in Canva.

On its own

  • Read Canva's technical documentation and tool list on its own, including a plain-text version
  • Register itself as a developer app with Canva's connector service

What it can't, and why

  • Create an accountA 'prove you're human' check blocks every sign-up page
  • Get a login tokenGetting a token also requires passing through the same human-only check
  • Make or edit a design, pay, or cancel a planNone of these are possible without an account
Blocked

Can an AI agent sign up for Canva on its own?

No. Sign-up: blocked. Cloudflare 'Verify you are human' challenge on every www.canva.com page, sign-up included (403 cf-mitigated: challenge headless; interstitial that did not clear in the browser).

Official server · no call worked

Does Canva have an MCP server, and can an agent connect to it?

Yes. Canva has an official MCP server.

A new agent can't get in on its own: in the drive of 12 Oct 2026, our agent stopped at sign up (it was blocked). Through the MCP server, 0 of our agent's 3 attempts worked.

What the drive found

APIOpenAPIMCP · official–CLI–SDK–llms.txt–Webhooks–Sandbox

Not reached in this drive: the API key, deleting the account and paying. Every checkpoint, in detail

For the team behind Canva.

Where agents stop in Canva today, and the fixes that get them further, highest impact first.

Stops at sign up

The fixes, highest impact first

  1. Let verified signed agents reach sign-upStep-by-step guide
  2. Allow agents to read llms.txt and .md docsStep-by-step guide
  3. Add a headless credential path for agentsStep-by-step guide
1 more fix
  1. Answer server/discover without a token
  • Claim it free and reply next to the result.
  • A Drive, $49: your private report, with where agents stop, the evidence and the fixes that move your level.
  • Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).
Get a DriveClaim it free
See the example report
Details

Your API, MCP server or CLI is the product? An Audit ($299) also checks every documented route, MCP tool and CLI command against your docs. Compare plans.

Already claimed it? Open it in your dashboard.

Rather not be driven? Block AgentDrivesAgent in robots.txt or write to us. We stop driving it ourselves; this page stays, with its date.

Embed the badge on your site

Driven · L1 · Needs a person badge

Behind the level.

Our agent couldn't get into Canva, so the work, its reliability and the crash test aren't measured. The part scores are what it could judge from the outside.

Part scores · level history

Part scores

Agent-ready setup

  • llms.txt
  • OpenAPI
  • MCP server
  • CLI

Not measured in this drive: Holds up, Docs match (part of an Audit).

Level history

  1. 6 Oct 2026L1Needs a person
  2. 12 Oct 2026L1Needs a person

For agents and builders.

The drive as data, every checkpoint and all 17 attempts.

How an agent connects · 3 tips

/api/tools/canva.json/tools/canva.mdMCP get_tool {"slug":"canva"}

  • Use the canva.dev docs with Accept: text/markdown; the llms.txt index is robots-disallowed.
  • MCP: https://mcp.canva.com/mcp for CIMD clients on Canva's allowlist; https://api.canva.com/connect/v1/mcp for Developer Portal apps with a client secret.
  • Every token needs a human to sign in and consent on www.canva.com; plan for that step.
Every checkpoint, in detail · 9 checkpoints
  1. DocsHeadlesscanva.dev docs answer headless, also as text/markdown (Accept: text/markdown, Vary: Accept); OpenAPI 3.0.0 with 67 operations at canva.dev/sources/connect/api/latest/api.yml. canva.dev's robots.txt disallows its own llms.txt and .md URLs; www.canva.com help pages sit behind a Cloudflare challenge.
  2. Sign upBlockedCloudflare 'Verify you are human' challenge on every www.canva.com page, sign-up included (403 cf-mitigated: challenge headless; interstitial that did not clear in the browser).
  3. VerifyNot reachedNo account: sign-up stopped at the Cloudflare challenge.
  4. KeyNot reachedMCP client registration (DCR) works headless (201), but consent redirects to www.canva.com/api/oauth/authorize, behind the same Cloudflare challenge. REST API needs an app in the Developer Portal (www.canva.com/developers/apps, also challenged). No API keys, no device flow.
  5. First callNot reachedWithout a token api.canva.com answers 401 invalid_access_token and both MCP endpoints 401 with resource_metadata.
  6. First actionNot reachedNo token, so no design could be created.
  7. PayNot reachedNo 402, x402, MPP, UCP or registry listing; we paid nothing. The OpenAPI has no billing operations. The pricing page is behind the Cloudflare challenge, so any checkout needs a human to get past it; whether a trial asks for a card is unknown.
  8. CancelNot reachednot tested: no plan or trial was started. No billing API or MCP billing tool documented; cancelling is in the web app, behind the same Cloudflare challenge.
  9. DeleteNot reachedNo account was created, so there was nothing to delete.
The attempt log · 17 attempts
CapabilityRouteResultEvidence
robots.txt: Read www.canva.com/robots.txt and www.canva.dev/robots.txtapidone ✓www.canva.com/robots.txt 200 (via Cloudflare). Group '*' allows the site but disallows /design/, /_ajax/, /template/*, /*/login/verify-email; GPTBot/ClaudeBot/CCBot groups Disallow: / with Allow for /create/, /features/. No Content-Usage or Content-signal line. www.canva.dev/robots.txt '*' disallows /*/llms.txt, /*/llms-full.txt and /*/*.md.
llms.txt: GET www.canva.com/llms.txt and www.canva.dev/docs/apps/llms.txtapifailed ✓www.canva.com/llms.txt -> 403 cf-mitigated challenge. www.canva.dev/llms.txt -> 302 to /docs/llms.txt, which robots.txt disallows. www.canva.dev/docs/apps/llms.txt: robots.txt disallows (exit 4).
Markdown docs: GET https://www.canva.dev/docs/connect/ with Accept: text/markdownapidone ✓Redirects to /docs/apps/rest-apis/; with Accept: text/markdown -> 200 content-type text/markdown; charset=utf-8, Vary: Origin, Accept. .md URLs are robots-disallowed (/*/*.md).
OpenAPI: GET https://www.canva.dev/sources/connect/api/latest/api.ymlapidone ✓200 YAML, openapi: 3.0.0, info.version 2024-06-18, server https://api.canva.com/rest, 67 operations (designs, exports, resizes, autofills, folders, comments, asset-uploads, image-generations, users/me/capabilities, oauth/token|revoke|introspect).
Well-known cards: GET /.well-known/ai-catalog.json, agent-card.json, agent.json, mcp/server-card.json, ucp on www.canva.com; mcp.canva.com/mcp/server-cardapifailed ✓www.canva.com well-knowns: 404 text/html (SPA page). https://mcp.canva.com/mcp/server-card: 401 invalid_token (behind auth). No A2A card, no AI catalog, no UCP profile.
MCP server/discover: POST server/discover (2026-07-28) to https://mcp.canva.com/mcp and https://api.canva.com/connect/v1/mcpmcpblockedBoth: HTTP 401 WWW-Authenticate Bearer resource_metadata=... (mcp.canva.com: error=invalid_token). PRM at https://mcp.canva.com/.well-known/oauth-protected-resource/mcp: resource https://mcp.canva.com/mcp, AS https://mcp.canva.com, 16 scopes. PRM for api.canva.com/connect/v1/mcp: AS https://www.canva.com. AS metadata mcp.canva.com: registration_endpoint (DCR), client_id_metadata_document_supported: true, code_challenge_methods plain+S256, grant types authorization_code, refresh_token, jwt-bearer; authorization_grant_profiles_supported id-jag.
Pricing / checkout: GET https://www.canva.com/pricing/apiblocked403 cf-mitigated: challenge (Cloudflare).
Find docs: Read REST API, authentication and MCP docs on canva.devapidone ✓canva.dev docs 200 as HTML and text/markdown: /docs/apps/rest-apis/, /docs/apps/rest-apis/authentication/ (OAuth 2.0 authorization code + PKCE; app must be created in the Developer Portal at canva.com/developers/apps), /docs/apps/mcp/, /docs/apps/mcp/tools/ (tools incl. generate-design, create-design, perform-editing-operations, export-design, resize-design via docs, autofill-design, comment-on-design, create-folder, generate-image...). www.canva.com/help/* pages answer 403 Cloudflare challenge headless.
Sign up: Open https://www.canva.com/signup headless, then in the browserbrowserblockedafter 12 s still the interstitial. Same on /, /login.
Verify email: Verify the sign-up emailnoneblockedNo account: sign-up stopped at the Cloudflare challenge.
Get API/MCP credentials: Register an MCP OAuth client (DCR) and open the authorization URLmcpblockedPOST https://mcp.canva.com/register -> 201 client_id issued (public client, token_endpoint_auth_method none). GET /authorize -> 302 to https://www.canva.com/api/oauth/authorize?...; that page: 403 cf-mitigated challenge headless and 'Just a moment...' Cloudflare interstitial in the browser.
First API/MCP call: GET https://api.canva.com/rest/v1/users/me without a tokenapiblocked401 application/json {"code":"invalid_access_token","message":"Access token is missing"}
First action: Create a design (POST /v1/designs or MCP generate-design)noneblockedNo account and no token (sign-up and consent behind Cloudflare challenge).
Pay step probes: Read pay_probe.json/pay_tx.json; look for 402, UCP, billing API, checkoutapiblockedpay_probe: challenges [], registries empty, well_known {}, MCP payment_tools [], checkout pages 0. pay_tx: refused (no 402 on product domain). /.well-known/ucp: 404. OpenAPI 67 operations: none for billing/subscriptions. /pricing/: 403 Cloudflare challenge.
Cancel: Cancel a plannoneskippedNot tested: no plan or trial was started. OpenAPI has no billing operations.
Delete account: Delete the accountnoneblockedNo account was created (sign-up behind Cloudflare challenge).
Remove the registered MCP client: DELETE https://mcp.canva.com/register/{client_id} (registration_client_uri)mcpfailed ✓404 Not Found. Registration response gave no registration_access_token; no documented way to remove a DCR client.

Also in Design.

All of Design, by level