figma-security-basics

# Figma Security Basics ## Overview Secure your Figma API integration: store tokens safely, apply least-privilege scopes, rotate credentials, and verify webhook signatures. ## Prerequisites - Figma PAT or OAuth app configured - Understanding of environment variables - `.gitignore` configured for secret files ## Instructions ### Step 1: Token Storage ```bash # .env (NEVER commit) FIGMA_PAT="figd_your-personal-access-token" FIGMA_OAUTH_CLIENT_SECRET="your-oauth-secret" # .gitignore .env .env.local .env.*.local *.pem ``` ```typescript // Validate token exists before any API call function getToken(): string { const token = process.env.FIGMA_PAT; if (!token) throw new Error('FIGMA_PAT is not set'); if (!token.startsWith('figd_')) { console.warn('Token does not have expected figd_ prefix'); } return token; } ``` ### Step 2: Least-Privilege Scopes Assign the minimum scopes needed for each use case: | Use Case | Required Scopes | |----------|----------------| | Read file structure | `file_content:read` | | Export images | `file_content:read` | | Post comments | `file_comments:write` | | Read variables (Enterprise) | `file_variables:read` | | Manage webhooks | `webhooks:write` | | Read team components | `team_library_content:read` | | Dev mode resources | `file_dev_resources:read` | **Deprecated scope:** `files:read` is deprecated. Use specific scopes like `file_content:read`, `file_comments:read` instead. ### Step 3: Token Rotation ```bash # PATs have a maximu...