figma-mcp-oauth-bypass

Figma's MCP server only lets recognized clients (like Claude Code) through its OAuth registration. Everyone else gets a 403.

This script pretends to be Claude Code, runs the OAuth flow in your browser, and saves the tokens so your actual client can use them.

Why

Figma allowlists the client_name field during dynamic client registration. If your MCP client sends anything other than a known name, the registration endpoint rejects it outright. There's no workaround on the client side; you need valid credentials first.

How

bun run figma-oauth.ts
# or
npx tsx figma-oauth.ts

It registers as "Claude Code", opens Figma's consent page in your browser, catches the redirect on localhost:9876, exchanges the code for tokens, and asks before writing anything to disk.

If it detects OpenCode, it'll offer to write directly to its auth store. Either way, credentials are printed so you can configure any client manually.

No dependencies. Works with Bun or Node 18+.

OpenCode

Add the Figma MCP server to your opencode.json config:

{
  "mcp": {
    "figma": {
      "type": "remote",
      "url": "https://mcp.figma.com/mcp"
    }
  }
}

This goes in your OpenCode config — run opencode debug paths to find it.

Then run the script. Tokens go into ~/.local/share/opencode/mcp-auth.json.

Other clients

Tokens are printed after auth completes. Use them however your client expects. PRs to add auto-detection for more clients are welcome.