Figma
Connect Figma with a personal access token or your own OAuth app and start workflows from design events.
What your agents can do
Agents search the Figma REST API to read files and version history, inspect published libraries, manage comments and dev resources, and work with variables when your plan allows it. Image rendering endpoints return download URLs. The Figma REST API does not provide general .fig upload or import.
Authentication
Both methods require Team ID, found in your Figma team's URL. Helios uses this team for webhooks. Team admin access is required to register them, and invite-only folders are excluded.
Personal access token
Create a token in your Figma account settings, select the scopes your agents need, and enter it under Personal access token in Helios. Include current_user:read for the connection check and webhooks:read and webhooks:write for triggers. Personal tokens expire and must be replaced manually.
Your own Figma app
Create a Figma OAuth app and register the callback URL shown by Helios. Select the scopes below in the app settings. Enter Client ID, Client secret and Team ID, then authorize access. Enable Admin access only when an organization admin will authorize the connection.
Helios requests these ordinary scopes from the scope reference:
current_user:read
file_comments:read file_comments:write
file_content:read
file_dev_resources:read file_dev_resources:write
file_metadata:read
file_versions:read
folders:read folder_metadata:read
library_assets:read library_content:read team_library_content:read
webhooks:read webhooks:writeAdmin access adds org:activity_log_read and org:discovery_read. Variables and library analytics require Enterprise, and this method does not request their scopes. Use a personal access token with those scopes instead.
AI usage and developer logs require plan access tokens, which this connection does not support. SCIM uses separate credentials and is outside this integration. Government API hosts are also outside this connection.
Helios refreshes OAuth tokens when needed and on a weekly schedule. Figma reuses refresh tokens and invalidates the previous access token for the user and app after a refresh. Use a dedicated OAuth app for this connection if another client also refreshes tokens for the same user.
Triggers
Webhooks require a Professional or higher plan. Starter supports API connections but not webhook registration. Helios still attempts setup and reports Figma's rejection as the reason for unavailable events.
Helios registers five team webhooks for the six events below. Figma delivers deletions through the file-update subscription. Team subscriptions count toward Figma's 20-webhook limit.
| Event | Meaning | Additional filters |
|---|---|---|
file.updated | A file changes after editing stops | File key and name |
file.deleted | A file is deleted | Actor ID |
file_version.created | A named version is created | Actor ID, version ID and label |
library.published | Library assets are published | Actor ID, asset key and name |
comment.created | A comment is added | Actor ID, comment ID, parent comment ID, mentioned user ID and text |
dev_mode_status.updated | A node's Dev Mode status changes | Actor ID, node ID, status and related URL |
Every event offers file key and file name filters. Names accept patterns without case sensitivity; IDs and URLs accept case-sensitive patterns. Version labels and comment text use case-insensitive contains matching. Status offers NONE, READY_FOR_DEV and COMPLETED.
Limits and errors
Figma may delay file-update events until 30 minutes of editing inactivity. Deleting a folder does not emit a deletion for every file. Large library publications arrive as separate deliveries. Helios verifies the configured passcode and removes it from trigger payloads.
Figma does not document a unique delivery ID, so identical payloads can be deduplicated even if they represent separate events.
See the webhook guide and API reference.
Last updated on