Figma OAuth Scopes

generated: '2026-11-12'
method: searched
source: https://developers.figma.com/docs/rest-api/scopes/
docs: https://developers.figma.com/docs/rest-api/scopes/
note: Scopes apply to personal access tokens and OAuth 2 tokens and do not supersede file/team/org permissions.
  The file_read scope is deprecated for OAuth 2 tokens. The Figma MCP server handles its own OAuth flow
  and does not use REST API scopes. in_spec marks scopes declared in the oauth2 securitySchemes of openapi/.
spec_only_scopes: []
scopes:
- name: current_user:read
  description: Read your name, email, and profile image.
  deprecated: false
  in_spec: true
- name: file_comments:read
  description: Read the comments for files.
  deprecated: false
  in_spec: true
- name: file_comments:write
  description: Post and delete comments and comment reactions in files.
  deprecated: false
  in_spec: true
- name: file_content:read
  description: Read the contents of files, such as nodes and the editor type.
  deprecated: false
  in_spec: true
- name: file_duplicate:write
  description: Duplicate files into folders. Available only to private OAuth apps in an Enterprise plan.
  deprecated: false
  in_spec: false
- name: file_dev_resources:read
  description: Read dev resources in files.
  deprecated: false
  in_spec: true
- name: file_dev_resources:write
  description: Write dev resources to files.
  deprecated: false
  in_spec: true
- name: file_metadata:read
  description: Read metadata of files.
  deprecated: false
  in_spec: true
- name: file_variables:read
  description: 'Read variables in files. Note: Enterprise plan only.'
  deprecated: false
  in_spec: true
- name: file_variables:write
  description: 'Write variables and collections in files. Note: Enterprise plan only.'
  deprecated: false
  in_spec: true
- name: file_versions:read
  description: Read the version history for files you can access.
  deprecated: false
  in_spec: true
- name: files:read
  description: Deprecated . Read files, folders, users, versions, comments, components, styles, and webhooks.
    While this scope will continue to work, it's highly recommended you use the granular scopes Figma
    provides. Because files:read is extremely permissive, more limited scopes such as file_content:read
    and file_comments:read provide enhanced security and stability by reducing the surface of access to
    your files.
  deprecated: true
  in_spec: true
- name: folder_metadata:read
  description: Read metadata of folders. This is the folders-era equivalent of project_metadata:read and
    is used by the GET folder metadata endpoint .
  deprecated: false
  in_spec: true
- name: folders:read
  description: List folders and files in folders. This is the folders-era equivalent of projects:read
    and is used by the folders endpoints .
  deprecated: false
  in_spec: true
- name: folders:write
  description: Create folders. Available only to private OAuth apps in an Enterprise plan.
  deprecated: false
  in_spec: false
- name: library_analytics:read
  description: 'Read your design system analytics. Note: Enterprise plan only.'
  deprecated: false
  in_spec: true
- name: library_assets:read
  description: Read data of individual published components and styles.
  deprecated: false
  in_spec: true
- name: library_content:read
  description: Read published components and styles of files.
  deprecated: false
  in_spec: true
- name: org:activity_log_read
  description: 'Read organization activity logs . Note: Enterprise plan only. Must be an organization
    admin.'
  deprecated: false
  in_spec: true
- name: org:ai_metering_usage_read
  description: 'Read organization AI usage . Note: Enterprise plan only. Must be an organization admin.'
  deprecated: false
  in_spec: false
- name: org:developer_log_read
  description: 'Read organization developer logs . Note: Enterprise plan with Governance+ only. Must be
    an organization admin.'
  deprecated: false
  in_spec: false
- name: org:discovery_read
  description: 'Read text event data in the organization. Note: Enterprise plans with Governance+ only.
    Must be an organization admin.'
  deprecated: false
  in_spec: false
- name: project_metadata:read
  description: Deprecated in favor of folder_metadata:read . Read metadata of projects (now "folders").
    Existing tokens continue to work.
  deprecated: true
  in_spec: true
- name: projects:read
  description: Deprecated in favor of folders:read . List projects (now "folders") and files in projects.
    Existing tokens continue to work.
  deprecated: true
  in_spec: true
- name: selections:read
  description: Read most recent selection in files you can access.
  deprecated: false
  in_spec: false
- name: team_library_content:read
  description: Read published components and styles of teams.
  deprecated: false
  in_spec: true
- name: team_members:write
  description: Invite members to teams. Available only to private OAuth apps in an Enterprise plan.
  deprecated: false
  in_spec: false
- name: teams:read
  description: Read team metadata. Available only to private OAuth apps in Professional, Organization,
    and Enterprise plans.
  deprecated: false
  in_spec: false
- name: teams:write
  description: Create teams. Available only to private OAuth apps in an Enterprise plan.
  deprecated: false
  in_spec: false
- name: webhooks:read
  description: Read metadata of webhooks.
  deprecated: false
  in_spec: true
- name: webhooks:write
  description: Create and manage webhooks.
  deprecated: false
  in_spec: true