--- title: Canva Shares S3 Based Architecture for Session... description: Canva redesigned its session revocation infrastructure to handle hundreds of millions of active sessions without networked database lookups on most auth... canonical: https://daily.dev/posts/canva-shares-s3-based-architecture-for-session-revocation-across-hundreds-of-millions-of-sessions-lvycjnjyl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Canva Shares S3 Based Architecture for Session Revocation Across Hundreds of Millions of Sessions | daily.dev og:description: Canva redesigned its session revocation infrastructure to handle hundreds of millions of active sessions without networked database lookups on most auth... og:url: https://daily.dev/posts/canva-shares-s3-based-architecture-for-session-revocation-across-hundreds-of-millions-of-sessions-lvycjnjyl og:image: https://api.daily.dev/og/posts/lvycJNjYL.png og:image:alt: Canva Shares S3 Based Architecture for Session Revocation Across Hundreds of Millions of Sessions og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Canva Shares S3 Based Architecture for Session Revocation Across Hundreds of Millions of Sessions **[InfoQ](https://daily.dev/sources/infoq)** · 3 min read · 1 upvotes · 0 comments ## Summary Canva redesigned its session revocation infrastructure to handle hundreds of millions of active sessions without networked database lookups on most auth requests. The new system stores revocation data in Amazon S3 as 30-minute immutable chunks of 16-byte binary records, which gateways download and hold as sorted in-memory indexes. This eliminated the coordinated MySQL load spike during deployments, cut revocation cache memory by 87.5%, reduced the session database to two read replicas, and enabled workers to process over 2,000 revocations per second. Conditional PUTs provide optimistic concurrency control, and ZooKeeper leader election reduces conflicts without being required for correctness. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did Canva reduce the memory footprint of its session revocation cache by 87.5%? Canva represents each revocation as a compact 16-byte binary record containing a principal and timestamp, stored in sorted arrays that allow direct in-memory searches. This compact encoding, combined with storing revocation data in Amazon S3 as 30-minute chunks within a 12-hour window rather than larger in-memory structures, cut the cache memory footprint by 87.5% compared to the prior design. _daily.dev surfaces engineering deep dives like this for teams optimizing large-scale caching and auth infrastructure._ ### Why did Canva choose Amazon S3 instead of Redis for session revocation data? Canva chose S3 to avoid operating an additional datastore while still getting durable storage for revocation records. S3's immutable objects and conditional PUTs/GETs act as coordination primitives, letting gateways detect changed chunks and asynchronous workers safely merge new revocations without needing Redis as a separate caching layer. _engineers weighing S3 versus Redis for coordination-heavy workloads can track real-world tradeoffs like this on daily.dev._ ### Why did Canva reject a refresh-token scheme instead of caching revocations in memory? A Canva engineer explained that frequent token refreshes would increase database load and make system availability dependent on the database during refresh operations. Keeping revocation data in memory instead let gateways authenticate requests without a networked datastore, while database load scaled with revocation write throughput rather than the number of gateway instances. _teams debating refresh-token versus cached-revocation auth designs can follow arguments like this on daily.dev._ ## Similar posts on daily.dev - [Session revocations at scale](https://daily.dev/posts/session-revocations-at-scale-freptfjr1) · Canva Engineering · 3 upvotes · 0 comments - [Redesign Authorization to monday.com Scale](https://daily.dev/posts/redesign-authorization-to-monday-com-scale-vahbvgdsl) · monday Engineering · 4 upvotes · 0 comments - [Building a Database on S3](https://daily.dev/posts/building-a-database-on-s3-z6q1mg0wr) · Metadata · 47 upvotes · 0 comments - [Amazon S3 Vectors now generally available with increased scale and performance](https://daily.dev/posts/amazon-s3-vectors-now-generally-available-with-increased-scale-and-performance-0gpqkus8w) · AWS · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#aws-s3](https://daily.dev/tags/aws-s3) [View this post on daily.dev](https://daily.dev/posts/canva-shares-s3-based-architecture-for-session-revocation-across-hundreds-of-millions-of-sessions-lvycjnjyl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Canva Shares S3 Based Architecture for Session Revocation Across Hundreds of Millions of Sessions","url":"https://daily.dev/posts/canva-shares-s3-based-architecture-for-session-revocation-across-hundreds-of-millions-of-sessions-lvycjnjyl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/canva-shares-s3-based-architecture-for-session-revocation-across-hundreds-of-millions-of-sessions-lvycjnjyl"},"datePublished":"2026-08-10T14:25:50.082Z","dateModified":"2026-09-14T07:41:29.488Z","description":"Canva redesigned its session revocation infrastructure to handle hundreds of millions of active sessions without networked database lookups on most auth...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/adaf0db73482b6e318b4a26fc7126faf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/adaf0db73482b6e318b4a26fc7126faf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/canva-shares-s3-based-architecture-for-session-revocation-across-hundreds-of-millions-of-sessions-lvycjnjyl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,aws-s3","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"Canva Shares S3 Based Architecture for Session Revocation Across Hundreds of Millions of Sessions"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/canva-shares-s3-based-architecture-for-session-revocation-across-hundreds-of-millions-of-sessions-lvycjnjyl#faq","mainEntity":[{"@type":"Question","name":"How did Canva reduce the memory footprint of its session revocation cache by 87.5%?","acceptedAnswer":{"@type":"Answer","text":"Canva represents each revocation as a compact 16-byte binary record containing a principal and timestamp, stored in sorted arrays that allow direct in-memory searches. This compact encoding, combined with storing revocation data in Amazon S3 as 30-minute chunks within a 12-hour window rather than larger in-memory structures, cut the cache memory footprint by 87.5% compared to the prior design. daily.dev surfaces engineering deep dives like this for teams optimizing large-scale caching and auth infrastructure."}},{"@type":"Question","name":"Why did Canva choose Amazon S3 instead of Redis for session revocation data?","acceptedAnswer":{"@type":"Answer","text":"Canva chose S3 to avoid operating an additional datastore while still getting durable storage for revocation records. S3's immutable objects and conditional PUTs/GETs act as coordination primitives, letting gateways detect changed chunks and asynchronous workers safely merge new revocations without needing Redis as a separate caching layer. engineers weighing S3 versus Redis for coordination-heavy workloads can track real-world tradeoffs like this on daily.dev."}},{"@type":"Question","name":"Why did Canva reject a refresh-token scheme instead of caching revocations in memory?","acceptedAnswer":{"@type":"Answer","text":"A Canva engineer explained that frequent token refreshes would increase database load and make system availability dependent on the database during refresh operations. Keeping revocation data in memory instead let gateways authenticate requests without a networked datastore, while database load scaled with revocation write throughput rather than the number of gateway instances. teams debating refresh-token versus cached-revocation auth designs can follow arguments like this on daily.dev."}}]} ```