Canva requires each user to authenticate individually, so there is no shared service account. Client registration uses client ID metadata documents, with dynamic client registration retained only for backward compatibility. Operations available to an agent match your own level of access: editing is only possible on designs and assets you can already edit.
Two practical constraints are worth planning around. Canva does not document a read-only connection mode, so scoping comes from permissions and from which workflows you build rather than from a connection flag. Canva also operates an allowlist for redirect URIs, applied through a waitlist, which affects how quickly a new client can be connected.
The editing model helps here. Canva’s transactional editing — start a transaction, perform operations, then commit or cancel — gives you a natural place to review before changes become permanent.