GitHub App permissions overview | Developer Docs
Skip to main content

GitHub App permissions overview

The Figma GitHub App connects GitHub repositories to Figma features such as Code Connect and Figma Make. The app requests the repository and organization permissions below. Each installation only grants repository access to the repositories selected by a GitHub administrator.

GitHub displays its Contents permission as Code during authorization. The links below use the permission names from GitHub's API documentation.

Read-only permissions​

PermissionWhy Figma requests itCurrent status
DeploymentsLets Figma read deployment and deployment-status information for deployment-aware experiences.🔄 In development
MembersLets Figma read organization members and membership information.🔄 In development
MetadataLets Figma identify connected repositories and accounts and read basic repository information during setup and configuration.✅ Used for GitHub setup and repository access

Read and write permissions​

PermissionWhy Figma requests itCurrent status
ChecksLets Figma create and update check runs that report validation results in GitHub.🔄 In development
CodeLets Figma read repository files and directory structure for Code Connect and other code-context features, and write commits and branches when exporting Figma Make code.✅ Used by Code Connect and Figma Make
Commit statusesLets Figma publish a status on a commit, such as the status of a Storybook preview deployment.🔄 In development
Pull requestsLets Figma read pull request details and create pull requests for features in development.🔄 In development
Repository creationLets Figma create private repositories when exporting Figma Make code to GitHub.✅ Used by Figma Make

User access tokens​

When a user authorizes the Figma GitHub App, GitHub allows the app to generate a user access token, which is an OAuth token used for requests made on that user's behalf.

As described in GitHub's documentation on authenticating on behalf of a user, the token's effective access is the intersection of the user's access and the permissions granted to the app. The token can access only resources the user can access, can perform only actions allowed by the app's permissions, and can operate only in accounts where the app is installed. It cannot grant the user any additional access.

Changelog​

  • 2026-09-23
    • Replaced the Administration permission with Repository creation for Figma Make's GitHub export feature.
    • Added the read-only Members permission and aligned the permission lists with GitHub's authorization screen.
  • 2026-07-30
    • Moved this page out of the Code Connect documentation because the Figma GitHub App supports multiple Figma products.
    • Updated each permission to reflect its current use in the Figma codebase.
    • Documented how user access tokens are limited by both the user's access and the app's permissions.
  • 2025-12-10
    • Renamed "Contents" permission to "Code" to match GitHub's authentication UI terminology.
    • Moved Code permission from read-only to read and write, combining usage descriptions for Code Connect and Figma Make.
  • 2025-10-08
    • Added the Administration and Contents permissions required for Figma Make's GitHub export feature.