{"slug":"figma","name":"Figma","domain":"figma.com","category":"Design tools","summary":"You can register a Figma OAuth app in minutes, and publish it right away as a private app for your own team or organization. Before people outside that team or org can connect, Figma has to review the app as a public app. The submission page says 5 to 10 business days, but developers report waits of two to four weeks or more.","tier":"reviewed","tierReason":"Users outside the team or organization that owns the app can't authorize it until Figma reviews and approves it as a public app.","quality":"researched","updatedAt":"2026-10-28","composio":{"status":"managed","note":"Composio has a managed Figma OAuth app, so you can prototype before you register your own. Register your own app and get it approved as public before launch, so your name and scopes are on the consent screen.","toolkit":"figma"},"totals":{"effort":{"min":2,"max":6,"unit":"hours"},"wait":{"min":1,"max":5,"unit":"weeks"},"firstConnection":"Today, in about 15 to 30 minutes. Draft apps work for you and your plan's admins."},"stages":[{"id":"build","name":"Draft app","whoCanConnect":"You and your Figma plan's admins.","userSees":"Figma's standard OAuth consent page with your app name and the scopes you requested.","effort":{"min":15,"max":30,"unit":"minutes"},"wait":{"min":0,"max":0,"unit":"minutes"},"unlock":"Publish the app as Private, which needs no review.","evidence":{"kind":"docs","sources":["s2"],"confidence":"high"}},{"id":"beta","name":"Private app","whoCanConnect":"Members of the team or organization you chose when you created the app.","userSees":"The normal consent page. There's no unverified-app warning.","effort":{"min":10,"max":20,"unit":"minutes"},"wait":{"min":0,"max":0,"unit":"minutes"},"unlock":"Republish the app as Public and pass Figma's review.","evidence":{"kind":"docs","sources":["s2","s5"],"confidence":"high"}},{"id":"launch","name":"Public app","whoCanConnect":"Any Figma user who authorizes the app.","userSees":"The normal consent page. If you choose to list the app, it also appears in the Figma Community.","effort":{"min":2,"max":5,"unit":"hours"},"wait":{"min":1,"max":5,"unit":"weeks"},"unlock":null,"evidence":{"kind":"community","sources":["s2","s4","s7","s8","s9"],"confidence":"medium"}}],"requirements":[{"id":"figma-account-team","label":"Figma account with a team or organization","detail":"Every app must belong to a team or organization. Users of a public app don't need to be members of it.","stage":"build","actor":"you","evidence":{"kind":"docs","sources":["s2"],"confidence":"high"}},{"id":"redirect-uri","label":"An HTTPS callback URL","detail":"You need an external callback URL that receives the authorization code. It must exactly match a redirect URL you registered on the app.","stage":"build","actor":"agent","evidence":{"kind":"docs","sources":["s2"],"confidence":"high"}},{"id":"listing-assets","label":"Logo, description and listing details","detail":"A public app needs a logo and description. A Community listing also needs a tagline of 100 characters or less, a landing page URL, a support contact and a cover image (1920x1080 recommended).","stage":"launch","actor":"you","evidence":{"kind":"docs","sources":["s2","s6"],"confidence":"high"}},{"id":"support-channel","label":"User support channel","detail":"Figma expects public app developers to give users a support email or help center.","stage":"launch","actor":"you","evidence":{"kind":"docs","sources":["s4"],"confidence":"high"}},{"id":"reviewer-access","label":"Test access for Figma's reviewer","detail":"You must write testing instructions. A testing video and trial access or login credentials for your product are optional.","stage":"launch","actor":"you","evidence":{"kind":"docs","sources":["s2","s6"],"confidence":"high"}},{"id":"privacy-policy","label":"Privacy policy and legal review","detail":"Figma's guidelines tell you to review the Developer Terms with legal counsel and prepare documents such as a privacy policy. No form field explicitly asks for one.","stage":"launch","actor":"you","evidence":{"kind":"docs","sources":["s4"],"confidence":"medium"}}],"steps":[{"id":"create-app","title":"Create the OAuth app in My Apps","actor":"you","stage":"build","time":{"min":5,"max":10,"unit":"minutes"},"detail":"Open My Apps, click Create a new app, enter a name and pick the owning team or organization. Figma then shows the Client ID and Client Secret. The secret is shown only once.","actions":["Go to figma.com/developers/apps","Click Create a new app","Enter the app name and choose a team or organization","Click Create, then copy the Client ID and store the Client Secret in your secrets manager","Click Done. The app is now a draft and the configuration modal opens"],"agentNote":"An agent can fill in the name and team once you're signed in. You must copy and store the client secret yourself.","gotcha":"The client secret is shown only once. If you lose it, you'll have to generate new credentials.","link":{"label":"Figma My Apps","url":"https://www.figma.com/developers/apps"},"evidence":{"kind":"docs","sources":["s2"],"confidence":"high"}},{"id":"add-redirect","title":"Add your redirect URI","actor":"agent","stage":"build","time":{"min":2,"max":5,"unit":"minutes"},"detail":"On the OAuth credentials page, add your OAuth client's callback URL. Figma only exchanges and refreshes tokens for registered URLs.","actions":["Open the app's configuration, then OAuth credentials","Add your redirect URI exactly as your OAuth client sends it","Save"],"agentNote":"An agent can copy the redirect URI from your OAuth client and paste it here.","gotcha":"The redirect_uri parameter must match a registered URL exactly, or the token exchange fails.","link":{"label":"Figma My Apps","url":"https://www.figma.com/developers/apps"},"evidence":{"kind":"docs","sources":["s2"],"confidence":"high"}},{"id":"select-scopes","title":"Select granular scopes","actor":"agent","stage":"build","time":{"min":5,"max":10,"unit":"minutes"},"detail":"On OAuth scopes, select only the scopes for the endpoints you call, such as current_user:read, file_content:read and file_comments:read. Request the same scopes, or a subset, in the authorization URL.","actions":["Open OAuth scopes","Tick the scopes your integration needs","Make sure your OAuth client requests the same scopes"],"agentNote":"An agent can tick the scopes and set the same list in your OAuth client.","gotcha":"files:read and file_read are deprecated and being removed, so use granular scopes. Some scopes only work for private apps or on Enterprise plans.","link":{"label":"Figma scopes reference","url":"https://developers.figma.com/docs/rest-api/scopes/"},"evidence":{"kind":"docs","sources":["s3","s5"],"confidence":"high"}},{"id":"configure-client","title":"Configure your OAuth client and test","actor":"agent","stage":"build","time":{"min":10,"max":20,"unit":"minutes"},"detail":"Use authorization URL https://www.figma.com/oauth and token URL https://api.figma.com/v1/oauth/token with HTTP Basic client auth. The refresh URL is https://api.figma.com/v1/oauth/refresh. PKCE with S256 is supported.","actions":["Set the authorization URL to https://www.figma.com/oauth","Set the token URL to https://api.figma.com/v1/oauth/token and the refresh URL to https://api.figma.com/v1/oauth/refresh","Set client authentication to HTTP Basic","Have a person enter the client ID and secret","Connect your own Figma account to test"],"agentNote":"An agent can set the URLs and run the test connection. A person must enter the client secret.","gotcha":"Authorization codes expire after 30 seconds, so exchange them right away. Embedded WebViews aren't supported. Refreshing a token invalidates the previous access token.","image":{"url":"https://developers.figma.com/img/rest-api/ExampleAppOAuth.png","alt":"Figma OAuth authorization page requesting scopes, with an Allow access button","source":"s2"},"evidence":{"kind":"docs","sources":["s2"],"confidence":"high"}},{"id":"publish-private","title":"Publish as a private app","actor":"you","stage":"beta","time":{"min":5,"max":15,"unit":"minutes"},"detail":"On Publish, choose Private, add the logo and description, confirm the scopes, and click Publish. Members of your team or organization can connect right away, with no review.","actions":["Open Publish and choose Private","Add the logo and description","Confirm the scopes on Review scopes","Click Publish"],"agentNote":"An agent can fill in the description. A person should upload the logo and click Publish.","gotcha":"A draft app can't make requests for anyone other than you and your plan's admins, including your own teammates.","link":{"label":"Figma My Apps","url":"https://www.figma.com/developers/apps"},"evidence":{"kind":"docs","sources":["s2","s5"],"confidence":"high"}},{"id":"prepare-public","title":"Prepare the public listing and test notes","actor":"you","stage":"launch","time":{"min":1,"max":4,"unit":"hours"},"detail":"Choose Public. Optionally, list the app in the Community. Fill in the tagline, description, landing page, support contact, cover image, a justification for each scope, and testing instructions for the reviewer.","actions":["Choose Public, and optionally list the app in the Community","Fill in the tagline, description, landing page URL and support contact","Add a cover image","Explain why the app needs each scope","Write testing instructions, and optionally add a video and a test login"],"agentNote":"An agent can draft text fields and scope justifications. You provide credentials, images and final approval.","gotcha":"Figma rejects apps that index or bulk-export file content (including for search or AI training), duplicate Figma features, or have incomplete features.","link":{"label":"Publish an app to the Figma Community","url":"https://help.figma.com/hc/en-us/articles/35074258201495"},"evidence":{"kind":"docs","sources":["s4","s6"],"confidence":"high"}},{"id":"submit-review","title":"Submit for review","actor":"you","stage":"launch","time":{"min":5,"max":10,"unit":"minutes"},"detail":"On Review and submit, tick the certification box and click Submit for review. Figma sends the decision to your account email.","actions":["Tick the certification box","Click Submit for review"],"link":{"label":"Figma My Apps","url":"https://www.figma.com/developers/apps"},"evidence":{"kind":"docs","sources":["s2","s6"],"confidence":"high"}},{"id":"await-review","title":"Wait for Figma's review","actor":"provider","stage":"launch","time":{"min":1,"max":5,"unit":"weeks"},"detail":"The submission page states 5 to 10 business days. Forum reports from 2026 describe waits of two weeks to over a month because of high volume. Rejections come with feedback, and you can resubmit.","gotcha":"Any substantial change to a published public app needs another review.","evidence":{"kind":"community","sources":["s7","s8","s9"],"confidence":"medium"}}],"scopes":{"intro":"Figma scopes don't change the review path. All public apps are reviewed, and you justify each scope. Some scopes are limited to private apps or certain plans.","tiers":[{"scope":"current_user:read, file_content:read, file_metadata:read, file_comments:read/write, file_versions:read, webhooks:read/write, library_content:read","grants":"Typical read and comment access to files the user can see","level":"basic","consequence":"Allowed for private apps, and for public apps after the standard review."},{"scope":"file_variables:read/write, library_analytics:read","grants":"Variables and library analytics","level":"sensitive","consequence":"Only works for users on Enterprise plans."},{"scope":"teams:read, teams:write, team_members:write, folders:write, file_duplicate:write","grants":"Team and folder management","level":"restricted","consequence":"Private apps only, so they can't be used in a public app."},{"scope":"org:activity_log_read, org:discovery_read, org:developer_log_read, org:ai_metering_usage_read","grants":"Organization admin data","level":"restricted","consequence":"Needs an Enterprise plan (some also need Governance+) and an organization admin."}]},"blockers":[{"symptom":"Teammates or customers can't authorize the app, but it works for you.","cause":"The app is still a draft, which only you and your plan's admins can use. Or the app is private and the user is outside your team or org.","fix":"Publish as private for your team. For anyone else, publish as public and pass review.","evidence":{"kind":"docs","sources":["s2"],"confidence":"high"}},{"symptom":"My Apps shows 'Update required' on an older app.","cause":"Figma's November 17, 2025 platform changes require existing apps to be republished as private or public, with granular scopes.","fix":"Republish from My Apps. Replace files:read with granular scopes. Users must reauthenticate only for newly added scopes.","evidence":{"kind":"docs","sources":["s5"],"confidence":"high"}},{"symptom":"Public review is pending for weeks with no update.","cause":"Figma's review queue has high volume.","fix":"Ask on the Figma Forum or through support. Staff have flagged long-pending reviews internally, but there's no official expedite.","evidence":{"kind":"community","sources":["s7","s8","s9"],"confidence":"medium"}},{"symptom":"Token exchange fails with an invalid code.","cause":"The authorization code expires after 30 seconds.","fix":"Exchange the code as soon as the callback receives it.","evidence":{"kind":"docs","sources":["s2"],"confidence":"high"}}],"unknowns":[{"question":"Is a privacy policy URL strictly required for public review?","why":"The guidelines suggest preparing one, but the listed form fields don't include one.","resolve":"Check the Publish form in My Apps, or ask Figma support."},{"question":"Is there a cap on how many users a private or public app can have?","why":"The docs don't mention a user cap.","resolve":"Ask on the Figma Forum or contact developer support."},{"question":"Is review time currently close to the stated 5 to 10 business days?","why":"The only data is forum anecdotes from March to July 2026.","resolve":"Check recent Figma Forum threads before you plan your launch date."}],"handoff":{"agentCan":["Fill in the app name and team after you sign in","Add your redirect URI and select scopes","Set the authorization, token and refresh URLs in your OAuth client","Draft the listing text, scope justifications and testing instructions","Run a test connection"],"youMust":["Sign in to Figma and own a team or organization","Copy and store the client secret, and enter it in your OAuth client","Upload the logo and cover image, and provide reviewer test credentials","Click Publish, accept the certification and submit for review","Respond to review feedback"]},"sources":[{"id":"s1","title":"Authentication","url":"https://developers.figma.com/docs/rest-api/authentication/","publisher":"Figma developer docs","kind":"official","checkedAt":"2026-10-28"},{"id":"s2","title":"OAuth apps","url":"https://developers.figma.com/docs/rest-api/oauth-apps/","publisher":"Figma developer docs","kind":"official","checkedAt":"2026-10-28"},{"id":"s3","title":"Scopes","url":"https://developers.figma.com/docs/rest-api/scopes/","publisher":"Figma developer docs","kind":"official","checkedAt":"2026-10-28"},{"id":"s4","title":"Figma Community App Review Guidelines","url":"https://help.figma.com/hc/en-us/articles/34963247780247","publisher":"Figma Help Center","kind":"official","checkedAt":"2026-10-28"},{"id":"s5","title":"Republish OAuth apps","url":"https://developers.figma.com/docs/rest-api/republish-oauth-apps/","publisher":"Figma developer docs","kind":"official","checkedAt":"2026-10-28"},{"id":"s6","title":"Publish an app to the Figma Community","url":"https://help.figma.com/hc/en-us/articles/35074258201495","publisher":"Figma Help Center","kind":"official","checkedAt":"2026-10-28"},{"id":"s7","title":"No update on OAuth app review for my app","url":"https://forum.figma.com/report-a-problem-6/no-update-on-oauth-app-review-for-my-app-53807","publisher":"Figma Forum","kind":"community","checkedAt":"2026-10-28"},{"id":"s8","title":"How long does it take for a Figma OAuth app to get approved","url":"https://forum.figma.com/ask-the-community-7/how-long-does-it-take-for-a-figma-oauth-app-to-get-approved-52433","publisher":"Figma Forum","kind":"search","checkedAt":null},{"id":"s9","title":"Public OAuth app review submitted March 26, no update","url":"https://forum.figma.com/ask-the-community-7/public-oauth-app-review-submitted-march-26-no-update-53331","publisher":"Figma Forum","kind":"search","checkedAt":null},{"id":"s10","title":"Composio managed auth toolkits","url":"https://docs.composio.dev/toolkits/managed-auth.md","publisher":"Composio docs","kind":"composio","checkedAt":"2026-10-28"}],"researchedAt":"2026-10-28T12:18:10.239Z","feedback":{}}