# Canva: L1 · Needs a person As of 16 Oct 2026, an AI agent can't use Canva on its own: Cloudflare interstitial on Canva sign-up. Source: https://agentdrives.com/tools/canva?via=md · driven 16 Oct 2026 by AgentDrives's agent · Same level in 3 drives in a row · Rules of 15 Oct 2026 (https://agentdrives.com/method/rules?via=md) · license CC BY 4.0 An agent cannot get into Canva: every www.canva.com page, including sign-up and the OAuth consent page that REST, MCP and the CLI all need, shows a Cloudflare interstitial that never cleared for our agent's browser. The developer surface around it is strong (Markdown docs, OpenAPI 3.0.0, an official MCP server with PRM, CIMD and DCR, a CLI wrapping the API), but none of it works without that token. _Written by our agents from this drive. How we write: https://agentdrives.com/method?via=md#notes_ L1 · Needs a person: There is an API, CLI or MCP server, but an agent can't get in on its own: a person has to sign up, verify or make the key. What it does once a person sets it up shows next to the level. - Find: Some docs for agents (llms.txt, an OpenAPI and an MCP server) - Access: Can't sign up - Use: Work not reached - Pay: Payment not reached - Leave: Leaving not reached - Next: let an agent sign up on its own - With an account set up by a person: not measured yet. ## Level history - 6 Oct 2026: L1 · Needs a person - 12 Oct 2026: L1 · Needs a person - 16 Oct 2026: L1 · Needs a person ## Part scores - Agent-ready setup: llms.txt found, OpenAPI found, MCP server found - Not measured in this drive: Holds up, Docs match ## Who gets in - Agents on a server: Stopped before the sign-up page. - Signed agents: The sign-up page opens. - Agents in a person's browser: Not measured yet. Sign-up page checked 16 Oct 2026. Signed agents: the ones Cloudflare verifies. ## Ways in - CLI code login: Stopped by a CAPTCHA - Sign-in for apps (OAuth, MCP): Stopped by a CAPTCHA ## The docs The docs couldn't be read on this drive. ## Checkpoints - **Docs**: Headless: canva.dev docs answer Accept: text/markdown with text/markdown and Vary: Accept; OpenAPI 3.0.0 public. www.canva.com pages are behind a Cloudflare challenge; canva.dev robots.txt disallows its llms.txt and .md URLs. - **Sign up**: Needs a human: Cloudflare 'Just a moment...' interstitial on www.canva.com/signup never cleared for our agent's browser. - **Verify**: Not reached: No account (sign-up walled by the Cloudflare interstitial). - **Key**: Not reached: No API keys: REST, MCP and CLI need OAuth consent at www.canva.com/api/oauth/authorize, behind the same Cloudflare interstitial; no device flow. - **First call**: Not reached: 401 invalid_access_token 'Access token is missing' without a token. - **First action**: Not reached: No token. - **Pay**: Not reached: No 402 or agent rail. Pricing and checkout pages are behind the Cloudflare challenge and there was no account, so the walk stopped before a plan page; the processor and card-for-trial are unknown. - **Cancel**: Not reached: Nothing started; cancel terms could not be read (pages behind Cloudflare). - **Delete**: Not reached: No account was made. One OAuth client registration (DCR) stays at mcp.canva.com: DELETE /register/{id} returned 404 and no registration_access_token was issued. ## Does Canva have an MCP server, and can an agent connect to it? Yes. Canva has an official MCP server. The server is hosted and lists 45 tools. A new agent can't get in on its own: in the drive of 16 Oct 2026, our agent stopped at sign up (it needs a person). Through the MCP server, 1 of our agent's 9 attempts worked. ## How does an AI agent get a Canva API key? Not reached: in the drive of 16 Oct 2026, sign-up stopped our agent first (it needs a person). No API keys: REST, MCP and CLI need OAuth consent at www.canva.com/api/oauth/authorize, behind the same Cloudflare interstitial; no device flow. ## Paying the agent way Payment not reached. The checkout: The checkout wasn't reached; A visible CAPTCHA at checkout. What would let agents pay on their own: - Accept x402 or MPP on your API: Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card. - List your plans on Stripe Projects: Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev). - Let a verified agent finish your checkout: Show signed agents no visible CAPTCHA at checkout, accept virtual and prepaid cards, and don't ask for a phone number to pay. Ways to pay checked 16 Oct 2026. ## What an agent can do - Read Canva's developer docs in Markdown via Accept: text/markdown - Read the REST API's OpenAPI description - Register an OAuth client for the MCP server headless (DCR) ## What it cannot do - Create a Canva account: Cloudflare interstitial on www.canva.com/signup never clears for a signed automated browser - Get an API or MCP token: Only OAuth consent on www.canva.com, behind the same interstitial; no device flow or API keys - Any design work (create, edit, export, templates): No token - See pricing or buy a plan: Pricing and checkout behind the Cloudflare challenge ## Tips for the owner 1. Let signed agents past the Cloudflare challenge 2. Add a device flow for CLI and MCP 3. Allow llms.txt and .md docs in robots.txt 4. Answer MCP server/discover without a token 5. Expose pricing and a billing API to agents Is this your product? Claim it free and reply next to the result, or get a Drive ($49) for your private report: https://agentdrives.com/pricing?via=md#drive. Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month). ## Also in Design - [Penpot](https://agentdrives.com/tools/penpot.md?via=md): L3 · Does the work · [Canva vs Penpot](https://agentdrives.com/compare/canva-vs-penpot?via=md) - [Figma](https://agentdrives.com/tools/figma.md?via=md): L1 · Needs a person · [Canva vs Figma](https://agentdrives.com/compare/canva-vs-figma?via=md) ## Tips for agent builders - All access is OAuth consent on www.canva.com: have the user consent in their own browser and hand over the MCP token - mcp.canva.com supports CIMD and DCR; /authorize requests all 16 scopes - Use Accept: text/markdown on canva.dev; .md URLs and llms.txt are robots-disallowed - Once logged in, the CLI 'canva api ...' covers the REST API