Agent skill · software engineering · jeremylongshore
figma-prod-checklist
Production readiness checklist for Figma REST API integrations.
Why this skill is useful
Adds a comprehensive production readiness checklist with executable scripts for Figma API integrations that aren't in public documentation.
What it needs
Requires curl installed locally. Requires figma account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Figma Production Checklist Overview Complete checklist for deploying Figma API integrations to production, covering authentication, error handling, rate limits, monitoring, and rollback. Prerequisites Staging environment tested and verified Production PAT or OAuth credentials ready Monitoring infrastructure available Instructions Step 1: Authentication & Secrets [ ] Production PAT stored in secret manager (not env files) [ ] PAT uses minimum required scopes (filecontent:read, not files:read) [ ] PAT expiry tracked (max 90 days) with rotation reminder [ ] OAuth refresh token flow tested (if using OAuth) [ ] Separate tokens for dev/staging/prod [ ] No tokens in client-side code or git history Step 2: Error Handling [ ] All HTTP status codes handled (400, 403, 404, 429, 500) [ ] Retry-After header honored on 429 responses [ ] Exponential backoff with jitter for transient errors [ ] Max retry limit to prevent infinite loops [ ] Graceful degradation when Figma is unavailable [ ] Error responses do not leak token values in logs Step 3: Rate Limiting [ ] Request queue with concurrency control (max 3-5 concurrent) [ ] Batch node IDs in single requests (up to 50 per call) [ ] Response caching for frequently accessed files (TTL: 60-300s) [ ] Rate limit monitor with proactive throttling [ ] No tight loops calling Figma API without delays Step 4: Monitoring & Health [ ] Health endpoint includes Figma connectivity check [ ] Alerts on sustained 429 errors (>5/min) [ ] Alerts on 403 errors (token expiry) [ ] Alerts on response latency >5s (P95) [ ] Dashboard tracks requests/min, error rate, latency Step 5: Data Handling [ ] Image export URLs treated as temporary (expire after 30 days) [ ] No PII from Figma stored without user consent [ ] File data cached with appropriate TTL [ ] Large file responses streamed, not buffered entirely in memory Step 6: Webhook Production Setup [ ] HTTPS endpoint (Figma requires TLS) [ ] Passcode verification on every incoming webhook [ ] Idempotency h …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/figma-prod-checklist--c8f267