Can an AI agent sign up for Figma on its own?

No. Sign-up: needs a human. Web form only. After Create account, Arkose Labs showed a visible puzzle ("Please solve this puzzle so we know you are not a robot").

Figmafigma.com

Can an AI agent use Figma?

As of 12 Oct 2026, an AI agent can't use Figma on its own: Arkose Labs puzzle on the sign-up form.

Level 1 · Needs a personAgents can't get in on their own.

Find: Docs for agents: llms.txt, an OpenAPI and an MCP server.
Access: Can't sign up.
Use: Work not reached.
Pay: Payment not reached.
Leave: Leaving not reached.

To reach L2 · Gets in: let an agent sign up on its own.

With an account set up by a person: not measured yet.

What the levels mean

Visit Figma Follow changes

Driven 12 Oct 2026Same level in 2 drives in a rowRules of 15 Oct 2026Claim this page

Written and checked by our agents from this drive's record. How we write.

Who gets in

Agents on a serverStopped by a CAPTCHA on the sign-up form.
Signed agentsThe sign-up page opens. The CAPTCHA on the form stops them too.
Agents in a person's browserNot measured yet.

Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. Where agents come from

What an agent can do in Figma.

On its own

Read Figma's public developer documentation and API reference without logging in
Find out how Figma's login and permissions system works, without using it

What it can't, and why

Create a Figma accounta visible robot-check puzzle blocks the sign-up form
Get an API key without a personkeys are only created inside the website's account settings
Do any design, whiteboard, slideshow or comment workall of it needs a signed-in account, which was never reached

1 more

Cancel or pay for a plannever tested, since no account or paid plan was started

Official server · a new agent can't get in alone

Does Figma have an MCP server, and can an agent connect to it?

Yes. Figma has an official MCP server. The server is hosted and signs an agent in with OAuth.

A new agent can't get in on its own: in the drive of 12 Oct 2026, our agent stopped at sign up (it needs a person).

What the drive found

APIOpenAPIMCP · officialCLISDKllms.txtWebhooks–Sandbox

Not reached in this drive: the API key, deleting the account and paying. Every checkpoint, in detail

For the team behind Figma.

Where agents stop in Figma today, and the fixes that get them further, highest impact first.

Stops at sign up

The fixes, highest impact first

Let signed agents through the sign-up checkStep-by-step guide
Add a device flow for API tokensStep-by-step guide
Open the MCP server to CIMD clientsStep-by-step guide

1 more fix

Serve markdown docs to agents Step-by-step guide

Claim it free and reply next to the result.
A Drive, $49: your private report, with where agents stop, the evidence and the fixes that move your level.
Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).

Get a Drive Claim it free

See the example report

Details

Your API, MCP server or CLI is the product? An Audit ($299) also checks every documented route, MCP tool and CLI command against your docs. Compare plans.

Already claimed it? Open it in your dashboard.

Rather not be driven? Block AgentDrivesAgent in robots.txt or write to us. We stop driving it ourselves; this page stays, with its date.

Embed the badge on your site

<a href="https://agentdrives.com/tools/figma" rel="nofollow"><img src="https://agentdrives.com/badge/figma.svg" alt="AgentDrives · Driven · L1 · Needs a person" height="24"></a>

Behind the level.

Our agent couldn't get into Figma, so the work, its reliability and the crash test aren't measured. The part scores are what it could judge from the outside.

Part scores · level history

Part scores

Agent-ready setup

llms.txt: found
OpenAPI: found
MCP server: found
CLI: found

Not measured in this drive: Holds up, Docs match (part of an Audit).

Level history

6 Oct 2026L1Needs a person
12 Oct 2026L1Needs a person

For agents and builders.

The drive as data, every checkpoint and all 22 attempts.

How an agent connects · 3 tips

/api/tools/figma.json /tools/figma.mdMCP get_tool {"slug":"figma"}

Start from developers.figma.com/llms.txt; the REST llms.txt lists every endpoint.
The REST API is mostly read-only: writes are limited to comments, variables, dev resources and webhooks; canvas edits need the Plugin API or the MCP server.
Expect an Arkose puzzle on sign-up: plan for a person to create the account and the token.

Every checkpoint, in detail · 9 checkpoints

DocsHeadlessdevelopers.figma.com/llms.txt (plus per-API llms.txt), REST docs, OpenAPI 3.1.0 in github.com/figma/rest-api-spec, MCP server docs; all fetched headless.
Sign upNeeds a humanWeb form only. After Create account, Arkose Labs showed a visible puzzle ("Please solve this puzzle so we know you are not a robot").
VerifyNot reachedNot reached: sign-up stopped at the Arkose puzzle; no mail arrived.
KeyNot reachedNot reached. Docs: personal access tokens are made in Settings > Security in the web app only; no API, CLI or device flow for a token.
First callNot reachedGET api.figma.com/v1/me without a token: 401 {"status":401,"err":"Missing credentials"}.
First actionNot reachedNo account and no token.
PayNot reachedNo 402, x402, MPP, UCP or registry listing; we paid nothing. Free Starter plan; paid seats ($16/$12/$3 a month) are bought in the web app; no billing API. Checkout itself not reached, so is from the docs and pricing page.
CancelNot reachednot tested: no plan or trial was started (no account reached). Help center: a paid Professional subscription must be canceled in the web app before deleting the account. Figma has paid plans, so cancelling is not tested.
DeleteNot reachedNo account was created. Docs: Settings > Account > Delete account, web app only, no API.

The attempt log · 22 attempts

Attempt log
Capability	Route	Result	Evidence
llms.txt: find llms.txt	api	done ✓	www.figma.com/llms.txt 404; developers.figma.com/llms.txt 200 text/plain 16125 B, links per-API llms.txt (rest-api, plugins, widgets, code-connect)
robots/aipref: read robots.txt	api	done ✓	www.figma.com/robots.txt 200; User-Agent: * group disallows /api/, /exit?, community search etc.; GPTBot etc. disallowed; no Content-Usage or Content-signal lines; no AgentDrivesAgent group
markdown docs: Accept: text/markdown on developers.figma.com/docs/rest-api/	api	failed ✓	returned content-type text/html, no Vary: Accept; /docs/rest-api/index.md 404 (NoSuchKey)
cards: AI catalog / A2A card / MCP server card	api	failed ✓	www.figma.com/.well-known/ai-catalog.json, agent-card.json, agent.json all 404 HTML; https://mcp.figma.com/mcp/server-card GET 405 JSON-RPC -32000 Method not allowed
MCP server/discover: POST server/discover 2026-07-28 to https://mcp.figma.com/mcp	api	blocked ✓	401 text/plain Unauthorized; WWW-Authenticate: Bearer resource_metadata="https://mcp.figma.com/.well-known/oauth-protected-resource",scope="mcp:connect"
MCP auth metadata: PRM + AS metadata	api	done ✓	PRM 200 JSON resource https://mcp.figma.com/mcp, AS https://api.figma.com; AS metadata: authorization_endpoint www.figma.com/oauth/mcp, registration_endpoint api.figma.com/v1/oauth/mcp/register (DCR), no client_id_metadata_document_supported, grants authorization_code, refresh_token, jwt-bearer, grant profile id-jag, S256 only, iss param supported; no agent_auth block; no device_authorization_endpoint
OpenAPI: find OpenAPI	api	done ✓	api.figma.com/openapi.json 404; github.com/figma/rest-api-spec openapi/openapi.yaml declares openapi: 3.1.0, 54 operationIds
sign up: Sign up with email+password at www.figma.com/signup	browser	blocked	After Create account, Arkose Labs enforcement (verify.figma.com/arkose_frame.html, figma-api.arkoselabs.com) showed "Verifying browser..." then a visible puzzle: "Verification \| Please solve this puzzle so we know you are not a robot \| Start puzzle". No headless sign-up route in docs (REST API has no account creation; OAuth needs an existing account).
sign up (human handoff): Hand the Arkose puzzle to a human	browser	blocked	Sign-up stays at the Arkose Labs puzzle.
first API call unauthenticated: GET https://api.figma.com/v1/me without a token	api	blocked	HTTP/2 401 {"status":401,"err":"Missing credentials"}
verify email: Read the verification mail	none	blocked	Sign-up never completed (Arkose puzzle); inbox the agent's inbox had no mail after 30 s wait
create API token headless: Create a personal access token through API/CLI	none	blocked	developers.figma.com/docs/rest-api/personal-access-tokens/: "click the account menu ... select Settings. Select the Security tab ... click Generate new token" (web UI only). OAuth apps need an account; remote MCP OAuth (AS api.figma.com) offers DCR at /v1/oauth/mcp/register but remote-server-installation says "Only clients listed in the Figma MCP Catalog like VS Code, Cursor, or Claude Code can connect"; no device flow. Plan access tokens are Organization/Enterprise only.
first real action: Create a file / comment	none	blocked	no account and no token: GET api.figma.com/v1/me answers 401 {"status":401,"err":"Missing credentials"}
pay step public probes: 402s, registries, well-known, checkout, trial card	api	done ✓	pay_probe.json: no 402 challenges (figma.com, api.figma.com; x402./mpp./agents. subdomains do not resolve), mpp.dev/Stripe Projects/x402 Bazaar empty, /.well-known/ucp none, MCP 401 (no tools seen), api.figma.com/openapi.json 404, llms.txt at developers.figma.com has no x402/MPP. pay_tx.json: refused, "no 402 on the product's own domain asks for USDC". Pricing page: "Starter Free Free limited access to Figma products"; Professional Full seat $16/mo, Dev seat $12/mo, Collab seat $3/mo. REST "Payments" API is for validating purchases of plugins/widgets/Community files, not buying Figma plans. No billing API in REST docs.
cancel plan: Cancel a paid plan	none	skipped	not tested: no plan or trial was started (no account). help.figma.com/hc/en-us/articles/360039826814: a paid Professional subscription must be canceled before account deletion; done in the web app.
delete account: Delete the account	none	blocked	No account was created (Arkose sign-up wall), nothing to delete. Docs (help.figma.com 360039826814): Settings > Account > Delete account, web UI only; no API route.
View org-wide member activity logs: check docs for this capability	none	blocked	REST llms.txt lists: > Complete reference for Figma's REST API. Access files, components, variables, comments, users, projects, webhooks, activity logs, and more from external tools and scripts. \|\| ## Activity Logs \|\| - [Activity Logs Introduction](https://developers.figma.com/docs/rest-api/activity-logs/): Overview of organization audit logging
Manage team members, seats, roles: check docs for this capability	none	blocked	REST llms.txt lists: > Complete reference for Figma's REST API. Access files, components, variables, comments, users, projects, webhooks, activity logs, and more from external tools and scripts. \|\| Authentication: Use a Personal Access Token (PAT) in the `X-Figma-Token` header for scripts and personal use, or implement OAuth2 for apps that act on behalf of users. OAuth apps require registering a \|\| ## Users
Security and access controls: check docs for this capability	none	blocked	REST llms.txt lists: File responses return a JSON tree of nodes representing the document structure. Each node has a type (FRAME, TEXT, RECTANGLE, etc.) and associated properties. Use node IDs to request specific subtrees \|\| ## SCIM API \|\| - [SCIM Introduction](https://developers.figma.com/docs/rest-api/scim/): Overview of SCIM provisioning for user and group management
Configure branding/fonts: check docs for this capability	none	blocked	not found in developers.figma.com/docs/rest-api/llms.txt
Billing groups/workspaces: check docs for this capability	none	blocked	not found in developers.figma.com/docs/rest-api/llms.txt
OAuth app / tokens: check docs for this capability	none	blocked	REST llms.txt lists: Authentication: Use a Personal Access Token (PAT) in the `X-Figma-Token` header for scripts and personal use, or implement OAuth2 for apps that act on behalf of users. OAuth apps require registering a \|\| - [Authentication](https://developers.figma.com/docs/rest-api/authentication/): Personal Access Tokens and OAuth2 flows \|\| - [Scopes](https://developers.figma.com/docs/rest-api/scopes/): OAuth scopes for controlling API access

Also in Design.

All of Design, by level

PenpotL3Gets in on its ownFigma vs Penpot
CanvaL1Can't sign up on its ownFigma vs Canva