Support for PAT (Personal Access Token) based auth in figma remote MCP

I also need this

I had reached out to figma for their support via the support email with the same query as in this community post and got the following response back about a month ago.

Hi Harish,
 
This is Clara from Figma Support. Thank you for reaching out with this question regarding the remote MCP server!
 
For your reference, Figma’s MCP server does not support authentication using personal access tokens and this cannot be enabled. We recommend MCP clients to connect using OAuth as described in our developer documentation here: Remote server. 
 
Thank you for your understanding and please let us know if you have any other open questions or concerns!

Best regards,

Clara
Techni

Hence, I pivoted to writing our own MCP using their public API’s. It does not cover all the tools offered in remote MCP but is was the best alternative to unblock at the moment. Kindly share any alternative solutions that worked for others.

Thanks for your reply

Hello ​@hakumar ,
Can you please tell the details of the API you used for achieving the behaviour of get_design_context  tool?

Do the Figma MCP team have any plans to support personal access tokens for remote access? 

Also, are there any plans to support service tokens?

I need this as well!

I hit this from a different angle, and it may be worth adding to the case here.

My client is Claude Code on macOS. It stores MCP OAuth grants inside the same credential item as its own account login, so logging out of the client — or switching between two accounts — discards the Figma grant. When that happened to me on 2026-08-30, the stored Figma access token still had roughly 90 days of life left and a refresh token beside it. Nothing had expired on Figma's side; the client simply threw the grant away, and I had to complete the browser consent again.

That is a case OAuth-only does not cover well, and it is different from the headless/CI argument already made in this thread. Even a fully interactive user on a supported client loses the grant to something that has nothing to do with Figma.

I filed the client-side half at https://github.com/anthropics/claude-code/issues/90647. For comparison, Cloudflare's hosted MCP servers accept a plain API token as a bearer credential, which makes the same failure a non-event there. I asked them to document that as a general option at https://github.com/cloudflare/mcp-server-cloudflare/issues/466.

I also opened a separate thread before I found this one, at https://forum.figma.com/suggest-a-feature-11/remote-figma-mcp-server-let-a-static-token-authenticate-as-an-alternative-to-oauth-57343. This thread is the older and better-supported one, so I would treat mine as a detail note and this one as the request.

If a static token is not acceptable for the write-to-canvas tools, scoping it to the read-only tools would still remove most of the pain.

The key point is that Figma’s remote MCP endpoint uses OAuth authentication, so simply passing a Figma PAT (figd_...) through Authorization or X-Figma-Token would not authenticate against https://mcp.figma.com/mcp. The local/desktop MCP flow is different.

For headless access, you would need a supported OAuth/service authentication flow from Figma. If Figma has not exposed PAT support for the remote MCP server, there is not an admin setting or header workaround that will make the PAT work.

This should be a highly requested feature. Especially when working with AI agents in the cloud and automatisations. E.g. having GitHub Copilot (in the cloud on github.com, not locally) working on a ticket, that has a figma file linked to it for more context. The cloud agent won’t be able to access this file, because there is no way of authenticating it.

There are several requests for this since months, but lastly no response from figma so far.