OAuth access tokens expire after 90 days by default and authorisation codes after 30 seconds. [3]
Guides · devtools · Popular APIs
Figma REST API (personal access token or OAuth app)
Generate a scoped personal access token for your own account, or create an OAuth app tied to a team or organisation; private OAuth apps publish without review, public ones are reviewed by Figma.
Researched · not yet run liveLast researched 25 October 2026 · Figma · provider site
Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Who owns what
PATs belong to a Figma user; OAuth apps belong to a team or organisation (their users need not belong to it).
- Figma account personal
- Figma team or organisation organisationoptionalNeeded to own an OAuth app.
Steps
Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.
Generate a personal access token
Account menu > Settings > Security > Personal access tokens > Generate new token; set expiration and scopes; copy it now.
verapli captures
FIGMA_ACCESS_TOKENhere by plain code: encrypted in your browser, never shown to AI.Where: https://www.figma.com/
Create an OAuth appoptional
At figma.com/developers/apps click Create a new app, name it and pick the team/org; copy the client ID and secret (secret shown once).
verapli captures
FIGMA_CLIENT_SECREThere by plain code: encrypted in your browser, never shown to AI.Where: https://www.figma.com/developers/apps
Publish the app (private or public)optional
Add logo, at least one redirect URL, scopes and description, then publish. Private apps (your team/org only) need no review; public apps need testing instructions and Figma review.
If something goes wrong (1)
- Other users can't authorise the app: Draft apps work only for you and plan admins; publish it (public apps must pass review first). [3]
Where: https://www.figma.com/developers/apps
Terms and gotchas
Plain-English summary, not legal advice. Each card links its source.
What you end up with
| Env var | Secret | Format | What it is |
|---|---|---|---|
FIGMA_ACCESS_TOKEN | secret | opaque token string | Personal access token |
FIGMA_CLIENT_ID | not secret | opaque id string | OAuth app client ID |
FIGMA_CLIENT_SECRET | secret | opaque secret string | OAuth app client secret |
Renewals
- Personal access token (expiration set at creation): every as chosen at creation [to verify maximum] [2]
For agents
The same entry as JSON: /api/v1/entries/figma/api · requirements /api/v1/requirements/figma/api · terms /api/v1/terms/figma/api.
Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp
> "What do I need for Figma REST API (personal access token or OAuth app), and how long will it take?"
→ tools/call requirements { "provider_id": "figma/api" }Sources
- Authentication PATs act as your account; scopes (e.g. file_content:read); OAuth apps recommended for acting on behalf of users and required for Activity Logs, Discovery and Embed APIs. · accessed 25 October 2026 · official
- Personal access tokens Settings > Security > Personal access tokens > Generate new token; set expiration and scopes; only chance to copy. · accessed 25 October 2026 · official
- OAuth apps My Apps / figma.com/developers/apps > Create a new app tied to a team or org; client secret shown only once; draft apps usable only by you and plan admins; private apps no review; public apps reviewed by Figma (testing instructions required); auth codes expire in 30 seconds; access tokens 90 days by default. · accessed 25 October 2026 · official
Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Figma is not affiliated with verapli.