Agent skill · security · jeremylongshore
figma-security-basics
Secure Figma API tokens, configure scopes, and validate webhook signatures.
Why this skill is useful
Provides specific security practices and code snippets for securing Figma API tokens and validating webhooks that are not widely known.
What it needs
Requires figma account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Figma Security Basics Overview Secure your Figma API integration: store tokens safely, apply least-privilege scopes, rotate credentials, and verify webhook signatures. Prerequisites Figma PAT or OAuth app configured Understanding of environment variables .gitignore configured for secret files Instructions Step 1: Token Storage Step 2: Least-Privilege Scopes Assign the minimum scopes needed for each use case: Use Case Required Scopes ---------- ---------------- Read file structure filecontent:read Export images filecontent:read Post comments filecomments:write Read variables (Enterprise) filevariables:read Manage webhooks webhooks:write Read team components teamlibrarycontent:read Dev mode resources filedevresources:read Deprecated scope: files:read is deprecated. Use specific scopes like filecontent:read, filecomments:read instead. Step 3: Token Rotation Step 4: Webhook Passcode Verification Figma webhooks use a passcode field (not HMAC signatures) for verification: Step 5: Security Checklist Output Secure token storage configured Minimum-privilege scopes applied Webhook passcode verification implemented Rotation schedule documented Error Handling Security Issue Detection Mitigation ---------------- ----------- ------------ Token in git history git log -p \ grep figd Revoke immediately, rotate, use BFG Repo Cleaner Expired PAT 403 errors in production Set calendar reminder for 80-day mark Over-scoped token Audit in Figma Settings Regenerate with minimum scopes Webhook spoofing Missing passcode check Always verify passcode before processing Examples Verify a token is valid and see who it acts as, without exposing it in shell history (Step 1 storage + /v1/me probe): Reject a forged webhook delivery (Step 4 passcode verification): Rotation runbook and the full checklist: references/token-rotation.md, references/security-checklist.md. Resources Figma API Scopes Figma Authentication Managing PATs Next Steps For production deployment, see figma-prod-checklist.
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/figma-security-basics--49c04e