Security and IT: Canva sync

Kahoot! asks for read-only access to your Canva designs and profile. It stores only the sign-in tokens and basic Canva account details it needs to keep the connection working.

With Canva sync you can bring your Canva designs into Kahoot! and use them as slides in a kahoot. This article is for IT administrators and security reviewers. It covers what Kahoot! can access in a connected Canva account, what it stores and how to remove access.

How connecting Canva works

You connect Canva by signing in to Canva and approving Kahoot!'s access. Your Canva password is never shared with Kahoot!.

1. In the Kahoot! creator, choose to import slides from Canva.
2. A Canva sign-in window opens. Sign in on Canva's site and review the requested permissions. If the Canva account has access to multiple teams or workspaces, select the relevant team from the "Select a team" dropdown before confirming.
3. When you approve, Canva sends Kahoot! a one-time authorization code.
4. Kahoot!'s servers exchange that code with Canva for an access token. The token is encrypted and held in Kahoot!'s database and is never stored in your browser.
5. Kahoot! shows your Canva presentations so you can pick one to import or sync.

Your browser must allow pop-ups from Kahoot! for the Canva sign-in window to open.

What permissions does Kahoot! request?

Kahoot! requests three read-only Canva permissions (OAuth scopes). It cannot edit, delete or share your designs, and it cannot create new designs in your Canva account.

What data does Kahoot! store?

Kahoot! stores the tokens that keep you connected and a few Canva account identifiers. It does not store your Canva password.

The list of your Canva designs is fetched from Canva each time you open it and is not saved. When you import or sync a design, its pages are exported as images and saved as slides in your kahoot, like any other content you add.

How do I disconnect Canva?

You can end the connection from Kahoot! or from Canva at any time. Open the Canva import panel, open the account menu and choose to log out of Canva. This ends the Canva session in Kahoot!.

Slides you already imported stay in your kahoots after you disconnect. To sync them again, you need to reconnect Canva.

FAQ for IT administrators

1. Can Kahoot! change or delete our Canva designs? No. All three permissions are read-only. Kahoot! can view and export designs but cannot edit, delete, share or create them.
    
2. Does Kahoot! see every design in the account? Kahoot! can only access designs that the signed-in Canva user has permission to view within the specific team or workspace selected during authorization. The picker lists presentations only. Designs belonging to other teams or non-presentation formats are not visible. Kahoot! saves a design only when imported or synced into a kahoot.
    
3. Does Kahoot! see every design in the account? Kahoot! can read the designs the signed-in Canva user can access. The picker lists presentations only. Kahoot! saves a design only when the user imports or syncs it.
    
4. Does Kahoot! store Canva passwords? No. Sign-in happens on Canva's site. Kahoot! receives only a token.
    
5. What do we need to allow on our network? Allow pop-ups from Kahoot! and access to Canva's sign-in and API domains. If your organization limits which third-party apps can connect to Canva, a Canva admin may need to approve Kahoot!.
    
6. Who can use Canva sync? Canva sync is available on Kahoot! plans that include slide sync