---
title: "Start Figma Oauth"
method: GET
path: "/figma/oauth/start"
tags: ["figma-oauth"]
---

# Start Figma Oauth

`GET /figma/oauth/start`

Begin the Figma OAuth flow: stash state+PKCE, return the Figma consent URL.

Returns the URL (rather than a redirect) so the FE can call this with its
authenticated session and then navigate the browser to Figma — a plain
browser navigation to this endpoint would carry no session header.

Masquerade must not reach this. It is a GET that writes, and
`get_company_id_helper` blocks masquerade by method, so the block does not
apply: `company_id` is the *effective* company, and `/callback` upserts the
token under it — a staffer connecting their own Figma account while wearing a
customer's lens keys it to that customer, and cannot then DELETE it, because
that route *is* method-blocked. Nothing enforces this yet; the only caller is
the dev-only harness at `/admin/feature/figma`, which is what keeps it out of
reach today. A real Figma UI needs an `is_any_masquerading()` refusal here and
on `/callback` first — see `_refuse_masquerade_vote` in
`backend/api/marketing/guidelines.py` for the shape.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/kobaltlabs/apis/fastapi.md) · [All operations](https://skmtc.dev/kobaltlabs/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kobaltlabs/fastapi/revisions/3ff4c0bd276b/schema)