The remote Figma MCP server (https://mcp.figma.com/mcp) can only be authenticated with the OAuth browser flow. That makes the connection only as durable as the MCP client's token store, and in practice it breaks often.
Concretely: my client (Claude Code on macOS) keeps MCP OAuth grants inside the same credential item as its own account login. Every time I log out of that client and log back in — or switch between two accounts, which I do routinely — the Figma grant is discarded and I have to run the browser authorization again. This happened again today, 2026-08-30.
The Figma token itself was nowhere near expiry when this happened. At the moment I was forced to re-authorize, the stored Figma access token still had about 2,160 hours (roughly 90 days) of life left, and a refresh token alongside it. So nothing expired on Figma's side; the grant was simply thrown away by the client.
I have reported the client-side half to the client's vendor. The request here is about the part only Figma can offer:
Please support a static token as an authentication method for the remote MCP server — a personal access token in a header, the way the Figma REST API accepts X-Figma-Token — as an alternative to OAuth.
Why it helps:
- It survives client-side credential resets. A token in a config file does not care that the editor logged out.
- It is the only workable path for headless and CI agents, which cannot open a browser to complete a consent screen.
- It matches what your own REST API already offers, so the credential model is familiar and the scopes are already defined.
- Cloudflare's hosted MCP servers already accept a plain API token as a bearer credential, so there is precedent among comparable remote MCP servers.
If a static token is not acceptable for the write-to-canvas tools, scoping it to read-only tools would still remove most of the pain.
Environment: Claude Code 2.1.251, macOS 26.5.2 (Apple silicon), Figma plugin 2.2.96, remote server https://mcp.figma.com/mcp.