Canva SSO "Grant access" fails with "Key issuance failed" (self-hosted RS 11.0) — worked 2 weeks ago, now consistently fails

[Jalil Butron]

Hi all,

Wondering if anyone has run into a similar issue authenticating Canva with ResourceSpace.

I'm running a self-hosted ResourceSpace 11.0 instance (SVN r29498, working copy confirmed via svn info) and I'm stuck on the Canva SSO integration after it stopped working following a full restart of my Docker host.

Background

The Canva "ResourceSpace" app's SSO ("Grant access") flow worked successfully from this exact RS instance and the same Canva account roughly two weeks ago. After a full restart of the machine running Docker (and the ResourceSpace container), the same flow now fails consistently.

What I found while investigating

• Attempting "Grant access" from the Canva app initially returned "Invalid system requested" from pages/user/user_api_session.php.
• Tracing the code, this comes from $api_issue_valid_destinations[$system] ?? false in user_api_session.php, checking against the $api_issue_valid_destinations array.
• My installed config.default.php only defines linkrui and tagquest as valid destinations — no canva entry.
• Using svn log/svn diff against the public SVN repo, I traced this:
  • r29355 (2026-07-15, "Adding Canva to API_ISSUE_VALID_DESTINATIONS to enable support for SSO", ticket q13788) added a canva entry to API_ISSUE_VALID_DESTINATIONS in include/definitions.php — but only on trunk.
  • r29360 (2026-07-16, "Changing API_ISSUE_VALID_DESTINATIONS to a config option") was merged into releases/11.0, and refactored the constant into an overridable config.default.php variable — but did not bring over the canva entry itself, only linkrui/tagquest.
  • Trunk's current config.default.php does have the full canva entry:

php

"canva" => [ "name" => "Canva", "url" => "https://auth.resourcespace.com/oauth/sso/callback", "querydata" => ["username", "email", "fullname"], "stateparam" => "state", ],

• I manually added this exact entry to my local config.php (matching trunk verbatim). This resolved the "Invalid system requested" error — the flow now correctly reaches auth.resourcespace.com/oauth/sso/callback.

Current issue

The callback now consistently returns:

HTTP 400 — "Key issuance failed. This sign-in link is not valid. Please start again from Canva."

This happens on fresh attempts, initiated directly from Canva (not a stale tab/link), using the same Canva account that worked previously. I've ruled out several things on my end:

• Confirmed my instance is publicly reachable via Tailscale Funnel (verified from outside my own network).
• Confirmed system clock/NTP sync is correct.
• Confirmed config.php is on a persistent bind mount (not reset by container restarts).
• Confirmed the canva entry in my config matches trunk's source exactly.

Questions

1. Is Canva SSO support in 11.0 something self-hosted instances are expected to configure manually (adding the canva entry to config.php), or is it not yet intended to be enabled outside of Labs/trunk?
2. Does auth.resourcespace.com require any separate registration/whitelisting for self-hosted instances, independent of the local config? If so, could this have lapsed or not persisted correctly?
3. Is there anything server-side that could explain a previously-working SSO connection failing after no changes on my end other than a routine restart?

Happy to provide additional diagnostics (request logs, timestamps, instance URL) via a private channel if useful. Thanks for any help!

---

Environment:

• ResourceSpace 11.0, SVN r29498 (local mods for a custom Flickr sync plugin, unrelated to this issue)
• Self-hosted via Docker Desktop on macOS
• Public access via Tailscale Funnel

[Joseph Brooke]

Hi,

This should be fixed in ResourceSpace version 11.0 after revision 29633. If you update to the latest revision you should hopefully no longer see the error. 

[Jalil Butron]

Hi Joseph,

Thanks for getting back to me so promptly! We are back in business on Canva.

Best,

Jalil