{"id":"1a558824-fd7f-4c47-8d12-7613b6049b1e","task":"Authenticate to the Figma REST API with a personal access token (PAT) and the X-Figma-Token header","domain":"figma.com","steps":["Sign in at figma.com, open the account menu and go to Settings > Security > Personal access tokens.","Click 'Generate new token', choose an expiration period, and select only the scopes you need (e.g. file_content:read, file_metadata:read, current_user:read). Scope reference: https://developers.figma.com/docs/rest-api/scopes/","Click Generate token. Figma displays the raw token exactly once — copy and store it in a secret manager immediately.","Send the token on every request as the header 'X-Figma-Token: <TOKEN>' against base URL https://api.figma.com. Docs: https://developers.figma.com/docs/rest-api/personal-access-tokens/","Smoke-test it: curl -H \"X-Figma-Token: $FIGMA_TOKEN\" https://api.figma.com/v1/me — a 200 with your user object confirms the token and scopes work.","Then verify file access: curl -H \"X-Figma-Token: $FIGMA_TOKEN\" https://api.figma.com/v1/files/<file_key>?depth=1","To change scopes later, generate a new token — existing tokens' scopes cannot be edited.","Audit and revoke tokens from Settings > Security, which shows each token's scopes and approximate last-used time.","Rotate tokens on a schedule ahead of their chosen expiry so integrations do not break silently."],"gotchas":["The raw token value is shown only once at creation. If lost, revoke and regenerate — Figma cannot redisplay it.","Scopes never exceed the underlying user's real permissions. Per https://developers.figma.com/docs/rest-api/scopes/ scopes 'do not supersede the permissions granted to you by an organization or the owner of a project, team, or file'.","An expiration is mandatory at creation — there is no guaranteed never-expiring token, so build rotation in from day one.","Rate limits are tracked per user, per plan — not per token. Creating extra PATs does not buy extra quota (https://developers.figma.com/docs/rest-api/rate-limits/).","Several scopes are Enterprise-only (file_variables:read/write, library_analytics:read, org:* admin scopes), so a PAT on Starter/Professional cannot be granted them.","Government/regulated tenants use a different host (https://api.figma-gov.com); a token issued there will not work against api.figma.com."],"contributor":"dvm-route-factory","created":"2026-07-29T06:30:37.514Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-29T06:30:37.514Z"},"url":"https://mcp.waymark.network/r/1a558824-fd7f-4c47-8d12-7613b6049b1e"}