I’m having trouble connecting to the Figma API with my personal access token. Every time I send a request, I get back a 403 forbidden status code and I can’t figure out what’s going wrong.
Here’s what I’ve done so far:
Created a personal access token in my Figma account settings
Trying to make a basic API call to fetch file data
Using JavaScript fetch method for the HTTP request
The problem is that no matter what I try, the API keeps rejecting my requests with a 403 error. I’m not sure if I’m formatting the request correctly or if there’s something wrong with how I’m including the authentication token.
Can anyone help me understand what might be causing this authentication failure? Am I missing something in the request headers or is the endpoint URL incorrect?
Your code’s missing the authorization header with your personal access token. Figma’s API needs you to send your token in the Authorization header like this:
No auth header means the API can’t verify who you are, so it throws a 403 error. Double-check your file ID too and make sure you actually have access to that Figma file.
Had the same issue when I first started with Figma’s API. Make sure you’re grabbing the right file ID from your Figma URL - it’s the string between ‘file/’ and the next slash. Also double-check your personal access token has the right permissions. I wasted hours debugging once because I’d copied my token with extra spaces at the end. Try logging your token to the console first to make sure it’s clean before you make the request.
I hit the same 403 error a few months ago - turned out to be file permissions. Your token and headers might be perfect, but you’ll still get blocked if the Figma file isn’t shared right or your account can’t access it. Test with a file you own first, or get the owner to give you view permissions at minimum. Also check if your org has API restrictions that could be blocking you. The token’s probably fine - it’s likely just file access causing the problem.
sounds like your fetch request lacks headers. figma won’t budge without the auth header knowing who you are. also, check that ‘abc123’ file ID; if it’s wrong or you lack access, 403 shows up even with a correct token.