Troubleshooting

Symptoms grouped by where in the workflow they appear, each with the cause and the fix.

Quick reference

Installation problems

The plugin will not activate

WordPress refuses activation while WooCommerce is inactive, showing "Webkul Canva Connect for Woocommerce needs WooCommerce. Activate WooCommerce first, then activate this plugin." This is enforced twice, by the Requires Plugins: woocommerce header and by the plugin's own activation hook.

Fix: install and activate WooCommerce 10.0 or later, then activate this plugin.

JWT library not found.: HTTP 500

The firebase/php-jwt dependency is missing, so no token can be verified and the Canva sidebar stays empty.

Fix:

cd wp-content/plugins/wkwc-canva-connect
composer install --no-dev --optimize-autoloader

Confirm vendor/autoload.php now exists. This only affects Git checkouts, the store ZIP ships with vendor/ included.

A licence notice appears in the site footer

Every installed Webkul module must be activated with a valid purchase code. Until that is done, WordPress shows a mandatory activation notice in the site footer and the storefront checkout is blocked.

Fix: go to Webkul WC Addons > License, enter the Purchase Code for WooCommerce Canva Connector, and confirm the Status column reads Approved. Full steps are in Installation, Step 5.

The settings page is not where the docs say

The page registers under Webkul WC Addons > Canva Connect when the Webkul submodules are present, and falls back to Settings > Canva Connect when they are not.

Fix (Git checkouts):

git submodule update --init --recursive

Either location works, the page is identical. Access needs the manage_woocommerce capability.

REST routes return 404

curl -I https://your-domain.com/wp-json/canva/v1/products

A 401 is healthy, the route exists and is demanding a token. A 404 means the rewrite rules were never flushed.

Fix: go to Settings > Permalinks, choose Post name, and click Save Changes.

Connection and OAuth problems

Client ID not set.: HTTP 400

{ "code": "no_key", "message": "Client ID not set.", "data": { "status": 400 } }

Fix: paste the Client ID (OC-…) from your Canva Integration into Webkul WC Addons > Canva Connect and save.

Canva rejects the redirect URI

The URI registered on the Canva Integration must match rest_url( 'canva/v1/callback' ) byte for byte. A trailing slash, http instead of https, or www. on one side only is enough to fail.

Fix: copy the value printed under Important URLs to paste in your Canva Developer Portal on your settings page, never type it by hand. See Redirect URIs & HTTPS.

Security check failed. Invalid state.

The state transient lives for 300 seconds, and is deleted the moment it is used.

Causes: more than five minutes spent on the consent screen; a reloaded or bookmarked callback URL; or an object cache that is dropping transients.

Fix: go back to the product and click Design with Canva again. If it recurs immediately, check that transients persist, a misconfigured persistent object cache is the usual culprit.

CSRF / security error on the button

The button link carries a wp_rest nonce, which expires after roughly 24 hours.

Fix: reload the product edit page (or the products list) and click the button from the fresh page. Clicking a link copied out of an old tab will not work.

Failed to get access token

The token exchange at https://api.canva.com/rest/v1/oauth/token was rejected.

Check, in order:

1. The Client Secret in WordPress matches the current secret in the Developer Portal. Rotating it in Canva invalidates the stored copy.
2. The Redirect URI sent at the exchange matches the registered one exactly.
3. Your server can make outbound HTTPS requests to api.canva.com, a firewall or proxy blocking egress produces this too.

The consent screen appears every time

The refresh token is not being persisted in the canva_refresh_token option.

Fix: confirm the option is writable (some hardened setups block update_option from REST context), and check the WooCommerce logs under WooCommerce > Status > Logs, source wkwc-canva-connect.

Canva app problems

Failed to load products. Please check if your WordPress site is accessible.

The sidebar reached the fetch but the request did not succeed. Work through these in order:

1: Is the store on HTTPS? The Canva editor is HTTPS, so a browser blocks any request to an http:// origin as mixed content. This is not fixable from the plugin side; the store must have a valid certificate.

2: Was the bundle built with the right host? CANVA_BACKEND_HOST is compiled into the JavaScript. It must be the site root, with no trailing slash and no /wp-json:

CANVA_BACKEND_HOST=https://your-domain.com npm run build

For a subdirectory install, include the subdirectory path: https://your-domain.com/store.

3: Does the App ID match? Open the browser devtools console in the Canva editor. A 401 with "Invalid App ID (aud)." means the App ID saved in WordPress is not the App the token was issued for.

4: Is the certificate chain complete?

curl -sS -o /dev/null -w '%{http_code} %{ssl_verify_result}\n' \
  https://your-domain.com/wp-json/canva/v1/products

Expect 401 0. A non-zero ssl_verify_result means an incomplete chain, install the intermediate certificates.

Blank sidebar in Canva

The bundle failed to load or failed to execute.

Fix: rebuild with npm run build and re-upload dist/app.js in the Developer Portal. Check the devtools console for the actual error, a build that stopped with "BACKEND_HOST is undefined." never produced a bundle at all.

CORS: header contains multiple values, but only one is allowed

Two layers are both sending Access-Control-Allow-Origin. The plugin already removes WordPress core's copy, so the second one is coming from your web server, an Apache Header always add, an Nginx add_header, or a server-level "allow CORS" plugin.

Diagnose: request a plain static file.

curl -I https://your-domain.com/wp-includes/js/jquery/jquery.min.js | grep -i access-control

If the header is present on a static asset, WordPress never ran, the source is the web server.

Fix, either remove the CORS rule from the server configuration, or tick Disable CORS Headers in Webkul WC Addons > Canva Connect so PHP stops sending its own. The plugin still sends Access-Control-Allow-Headers, Access-Control-Allow-Methods and Access-Control-Max-Age, which matters because hand-written server CORS blocks usually omit Authorization and would reject every bearer token.

Equivalent in code:

add_filter( 'wkwc_canva_allowed_origin', '__return_empty_string' );

⚠️ Select an image on canvas first to replace it!

Not an error. Clicking a sidebar thumbnail replaces a selected image on the canvas, so something must be selected first.

Fix: click the image on the canvas (Canva draws a border around it), then click the thumbnail.

No ✨ Current Product section

The app could not match the open design to a product. Either the design was not created through Design with Canva, or the _canva_design_id post meta is missing.

Fix: close the design and reopen it from the product's Design with Canva button. The catalogue below still works either way, you can save to any product from its own card.

Save and upload problems

The design saves but the product image never changes

media_handle_sideload() could not write the file.

Fix: make wp-content/uploads writable by the web server user.

chown -R www-data:www-data wp-content/uploads
find wp-content/uploads -type d -exec chmod 755 {} \;
find wp-content/uploads -type f -exec chmod 644 {} \;

Also confirm disk space, and that upload_max_filesize and post_max_size in PHP are large enough for the image export.

❌ Failed to Save! immediately

The Canva export never completed, or returned no valid image.

Fix: make sure the canvas has content, then click again. Check the browser devtools console for the underlying export error.

Return navigation problems

No active session found.

The canva_token_{post_id} transient lives for one hour. Returning after that finds no session.

Fix: nothing is lost. Close the tab, reopen the product in WordPress, and click Design with Canva, the stored _canva_design_id reopens the same design.

Returning lands on the wrong product

The return endpoint infers the product from the most recent session transient, not from the request. With two designs open at once, both return buttons resolve to whichever session was started last.

Fix: work on one design at a time, or navigate to the correct product manually in WordPress.

Diagnostic commands

Are the routes registered?

curl -I https://your-domain.com/wp-json/canva/v1/products
# expect: HTTP/2 401

Is HTTPS valid end to end?

curl -sS -o /dev/null -w 'status=%{http_code} tls=%{ssl_verify_result}\n' \
  https://your-domain.com/wp-json/canva/v1/callback
# expect: status=200 tls=0

Which CORS headers actually go out?

curl -sI -X OPTIONS https://your-domain.com/wp-json/canva/v1/products \
  -H 'Origin: https://app-example.canva-apps.com' | grep -i access-control
# expect exactly one Access-Control-Allow-Origin line

Are the credentials saved?

wp option get canva_app_id
wp option get canva_client_id
wp option get canva_refresh_token

What is the plugin logging? JWT verification failures are written to the WooCommerce logger under the source wkwc-canva-connect. Read them at WooCommerce > Status > Logs.

Still stuck?

🎟 Support Portal https://webkul.uvdesk.com

📧 Email: [email protected]

Include your WordPress and WooCommerce versions, the PHP version, the exact error message, and the relevant lines from WooCommerce > Status > Logs.