GitHub App permissions overview
The Figma GitHub App connects GitHub repositories to Figma features such as Code Connect and Figma Make. The app requests the repository permissions below. Each installation only grants access to the repositories selected by a GitHub administrator.
GitHub displays its Contents permission as Code during authorization. The links below use the permission names from GitHub's API documentation.
Read-only permissions
| Permission | Why Figma requests it | Current status |
|---|---|---|
| Metadata | Lets Figma identify connected repositories and accounts and read basic repository information during setup and configuration. | ✅ Used for GitHub setup and repository access |
| Deployments | Lets Figma read deployment and deployment-status information for deployment-aware experiences. | 🔄 In development |
Read and write permissions
| Permission | Why Figma requests it | Current status |
|---|---|---|
| Administration | Lets Figma create private repositories when exporting Figma Make code to GitHub. | ✅ Used by Figma Make |
| Code | Lets Figma read repository files and directory structure for Code Connect and other code-context features, and write commits and branches when exporting Figma Make code. | ✅ Used by Code Connect and Figma Make |
| Checks | Lets Figma create and update check runs that report validation results in GitHub. | 🔄 In development |
| Commit statuses | Lets Figma publish a status on a commit, such as the status of a Storybook preview deployment. | 🔄 In development |
| Pull requests | Lets Figma read pull request details and create pull requests for features in development. | 🔄 In development |
User access tokens
When a user authorizes the Figma GitHub App, GitHub allows the app to generate a user access token, which is an OAuth token used for requests made on that user's behalf.
As described in GitHub's documentation on authenticating on behalf of a user, the token's effective access is the intersection of the user's access and the permissions granted to the app. The token can access only resources the user can access, can perform only actions allowed by the app's permissions, and can operate only in accounts where the app is installed. It cannot grant the user any additional access.
Changelog
- 2026-07-30
- Moved this page out of the Code Connect documentation because the Figma GitHub App supports multiple Figma products.
- Updated each permission to reflect its current use in the Figma codebase.
- Documented how user access tokens are limited by both the user's access and the app's permissions.
- 2025-12-10
- Renamed "Contents" permission to "Code" to match GitHub's authentication UI terminology.
- Moved Code permission from read-only to read and write, combining usage descriptions for Code Connect and Figma Make.
- 2025-10-08
- Added the Administration and Contents permissions required for Figma Make's GitHub export feature.