Canva export links last 24 hours: copy the file, also from Sume

Canva's export job gives you download URLs that expire after 24 hours, so a pipeline that exports a design must copy the file to its own storage inside that window. The same habit is right for media from Sume: the docs call signed upload and download URLs temporary secrets and do not promise a fixed life for them, so copy results as soon as a job completes.

Canva's facts are from its Create design export job reference, read 2026-10-10. Sume's are from the Authentication and Jobs and results docs.

What the Canva page says

POST https://api.canva.com/rest/v1/exports starts an export job. Formats are JPG, PNG, GIF, PPTX, MP4, PDF, CSV and HTML, and MP4 comes in 480p, 720p, 1080p and 4k, horizontal or vertical. The job moves through in_progress to success or failed, and download URLs expire in 24 hours. The page also lists per-user and per-app rate limits, including 20 requests a minute per user.

A copy step that is safe to repeat

Put the copy in the same worker that learns the job finished, before you tell anyone it is done. Write the bytes to your own bucket under a key built from the job id, and make the step idempotent: if the key already exists, skip the download. Then store your own URL and show that in your product, not the vendor's link.

For Sume, fetch the result once the status is completed and result_ready is true. A result read before then returns 409 job_not_completed, which is a signal to wait, not a failure. Send your API key on content URLs from the /v1/videos route.

Why 24 hours is still a long window

A day is plenty for a worker that runs when a job ends, and too short for a batch you plan to download next week. If you export many designs overnight, put the copy inside the export loop, not in a later cleanup. Canva's rate limits make that loop slower than you might expect, so plan the batch size from the numbers on its page.

Never put a signed link in a log, a ticket or a screenshot. Sume's guidance is explicit about that, and a link you can still open for another 20 hours is as good as a password for that file.

Checklist before you ship the pipeline

Run the whole path once with a real design and a real generated clip, and look at what you actually store. A pipeline that passes in a demo can still keep only the vendor link in the database, which works until the link stops working.

• Store your own copy and your own URL, keyed by the vendor job id.
• Make the copy step idempotent so a retry never writes twice.
• Record the export format and, for video, the resolution you asked for.
• Alert when a job is completed but the copy failed, so a human can act inside the window.
• Keep vendor links out of logs, tickets and chat.