Figma

Overview

Connect your users to Figma for accessing design files, variables, comments, and developer resources.

Property	Value
Provider ID	figma
Category	Design
PKCE	Supported
Token refresh	Automatic
Redirect URI	Shown in Developer Portal

Step 1: Create a Figma OAuth App

Go to the Figma My apps page

Navigate to figma.com/developers/apps (or click My Apps in the Figma top toolbar) and sign in.

Create a new app

Click Create a new app in the upper-right corner. Enter a name for the app, select the team or organization it belongs to, and click Create.

Get credentials

Copy the Client ID and Client Secret immediately and store them securely — this is the only time Figma shows the Client Secret.

Configure the redirect URL

In the configuration flow, open the OAuth credentials page, click Add a redirect URL, and add the Alter callback URL from the Developer Portal.

Select OAuth scopes

On the OAuth scopes page, select every scope the integration will request — only a subset of the scopes selected here can be requested at authorization time.

Publish the app

Publish the app: private apps (the default) publish immediately for the selected team or organization; public apps are reviewed by Figma before they can authorize users.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Figma provider

Go to OAuth Providers > Add Provider > Figma.

Enter credentials

• Client ID: Paste your Figma Client ID
• Client Secret: Paste your Figma Client Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
current_user:read	Read the authenticated user’s name, email, and profile image
file_content:read	Read the contents of files (nodes, layers, editor type)
file_metadata:read	Read metadata of files (name, last modified, folder, team)
file_comments:read	Read comments and comment reactions in files
file_comments:write	Post and delete comments and reactions in files
file_versions:read	Read the version history for accessible files
file_dev_resources:read	Read developer resources linked to Figma files
file_dev_resources:write	Create and modify developer resources in Figma files
file_variables:read	Read variables in Figma files (Enterprise plan only)
file_variables:write	Create and modify variables in Figma files (Enterprise plan only)
selections:read	Read the most recent selection in accessible files
library_analytics:read	Read design system analytics (Enterprise plan only)
library_assets:read	Read data of individual published components and styles
library_content:read	Read published components and styles of files
folder_metadata:read	Read metadata of folders (v2 folders endpoints; replaces project_metadata:read for apps created after August 2026)
folders:read	List folders and the files in them (v2 folders endpoints; private OAuth apps only; replaces projects:read for apps created after August 2026)
project_metadata:read	Read metadata of projects via the v1 endpoints (deprecated by Figma in August 2026; only apps created before then can still enable it)
projects:read	List projects and the files in them via the v1 endpoints (deprecated by Figma in August 2026; only apps created before then can still enable it)
team_library_content:read	Read published components and styles of teams
webhooks:read	Read metadata of webhooks
webhooks:write	Create and manage Figma webhooks

Notes

• Figma deprecated the legacy files:read / file_read scopes in favor of the granular scopes above. For most read-only integrations, file_content:read plus file_metadata:read is sufficient.
• Figma renamed projects to folders in August 2026. Apps created since then can only select folders:read / folder_metadata:read (the v2 folders endpoints; folders:read is limited to private OAuth apps). Apps created before then keep projects:read / project_metadata:read, which the v1 project endpoints still require: request the family the app has enabled, and enable the folder scopes on the Figma app before switching an integration to the v2 endpoints.
• A newly created app starts in a draft state: only the creator and plan admins can test it. It must be published (privately or publicly) before other users can authorize it; only public apps go through Figma’s review.
• See the Figma OAuth apps documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
postComment	write	POST	/v1/files/{file_key}/comments
deleteComment	delete	DELETE	/v1/files/{file_key}/comments/{comment_id}
getComments	read	GET	/v1/files/{file_key}/comments
postVariables	delete, write	POST	/v1/files/{file_key}/variables
postWebhook	admin	POST	/v2/webhooks
putWebhook	admin	PUT	/v2/webhooks/{webhook_id}
deleteWebhook	admin, delete	DELETE	/v2/webhooks/{webhook_id}
getWebhook	read	GET	/v2/webhooks/{webhook_id}
getWebhooks	read	GET	/v2/webhooks
getTeamWebhooks	read	GET	/v2/teams/{team_id}/webhooks
getFile	read	GET	/v1/files/{file_key}
getFileNodes	read	GET	/v1/files/{file_key}/nodes
getFileMeta	read	GET	/v1/files/{file_key}/meta
getFileVersions	read	GET	/v1/files/{file_key}/versions
getFileComponents	read	GET	/v1/files/{file_key}/components
getFileStyles	read	GET	/v1/files/{file_key}/styles
getDevResources	read	GET	/v1/files/{file_key}/dev_resources
getImages	read	GET	/v1/images/{file_key}
getLocalVariables	read	GET	/v1/files/{file_key}/variables/local
getPublishedVariables	read	GET	/v1/files/{file_key}/variables/published
getComponent	read	GET	/v1/components/{key}
getStyle	read	GET	/v1/styles/{key}
getMe	read	GET	/v1/me
getProjectFiles	read	GET	/v1/projects/{project_id}/files
getTeamProjects	read	GET	/v1/teams/{team_id}/projects
getTeamComponents	read	GET	/v1/teams/{team_id}/components
getTeamStyles	read	GET	/v1/teams/{team_id}/styles