---
title: "Start Figma Oauth"
method: GET
path: "/figma/oauth/start"
tags: ["figma-oauth"]
---

# Start Figma Oauth

`GET /figma/oauth/start`

## Request

- Base URL: `https://api.kobaltlabs.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.kobaltlabs.com/figma/oauth/start`
- Auth: none declared

Begin the Figma OAuth flow: stash state+PKCE, return the Figma consent URL.

Returns the URL (rather than a redirect) so the FE can call this with its
authenticated session and then navigate the browser to Figma — a plain
browser navigation to this endpoint would carry no session header.

Masquerade must not reach this. It is a GET that writes, and
`get_company_id_helper` blocks masquerade by method, so the block does not
apply: `company_id` is the *effective* company, and `/callback` upserts the
token under it — a staffer connecting their own Figma account while wearing a
customer's lens keys it to that customer, and cannot then DELETE it, because
that route *is* method-blocked. Nothing enforces this yet; the only caller is
the dev-only harness at `/admin/feature/figma`, which is what keeps it out of
reach today. A real Figma UI needs an `is_any_masquerading()` refusal here and
on `/callback` first — see `_refuse_masquerade_vote` in
`backend/api/marketing/guidelines.py` for the shape.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/kobaltlabs/apis/kobaltlabs-api.md) - [All operations](https://skmtc.dev/kobaltlabs/apis/kobaltlabs-api/llms.txt) - [OpenAPI document](https://skmtc.dev/kobaltlabs/apis/kobaltlabs-api/revisions/8587332d5e43?raw)