Canva REST APIs + MCP vs Shotstack

Canva REST APIs + MCP

OpenAPI 3.0 with 59 described operations, per-user rate limits and a 78-value error code enum. No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant.

Shotstack

A public OpenAPI definition, Markdown docs, a hosted MCP server with OAuth and a free watermarked sandbox let an agent draft, check and render video with little setup. API keys have no scopes, webhooks are unsigned, no security contact or certification of Shotstack's own was found, and the published Node and Python SDKs date from July 2024.

Canva REST APIs + MCP

1. Call the user capabilities endpoint before autofill, brand templates or resize, which need Pro or above
2. Poll export, upload and autofill jobs with exponential backoff and download results within 24 hours
3. Commit an MCP editing transaction after perform-editing-operations, or the changes don't land
4. Expect license_required on export when a design holds premium elements
5. Read page_number, not the deprecated index, from Get design pages

Shotstack

1. Fetch https://shotstack.io/docs/api/api.edit.json and the conventions guide before writing an edit. Track order is reversed, so the first track renders on top
2. Render in stage first. It is free and watermarked, but AI generation there is charged from the production credit balance
3. Call POST /generate/quote before POST /generate, and send an Idempotency-Key header on generation. POST /render has no idempotency key, so do not resubmit blindly
4. Do not store the url from the render status response. It expires after 24 hours. Use the CDN address built from owner and the render id
5. On a 429, wait for the 60-second window to reset and retry with backoff. Limits are per API key, 300 a minute on the Edit API in production