Figma Import Access: Understand Tokens, File Links and Private Management Links

A Figma import involves several pieces of information that serve different purposes. The design link identifies the file. The personal access token authorizes the API request. The Swelik public link lets someone view the exported design. The private management link lets the owner update or delete that preview.

Keeping these roles separate prevents a common mistake: sending the client more access than the review requires. This guide explains the current Swelik workflow and the checks to make before entering a credential.

Start with access to the actual design file

Open the Figma file using the account that will provide the token. Confirm that it is the intended file and that you can access the design. A valid credential for a different account does not automatically grant access to this project's content.

If the file belongs to a client or another organization, use the access arrangement approved for that work. Do not ask someone to send their personal token simply because you need a review export. They may prefer to provide a PDF or grant suitable file access through their normal process.

The file link and credential solve different problems. A correctly copied link cannot compensate for missing permission, and a token cannot make an unrelated URL identify the correct file. Check both before investigating rendering issues.

Understand what the token does

Figma's authentication documentation describes personal access tokens as credentials used to make API requests through the associated account. The file_content:read scope is relevant to reading design content. Follow Figma's current setup instructions rather than relying on an old screenshot of its settings interface.

Treat the token as a secret. Do not paste it into a public comment, project title, source-code repository or client message. When sharing a screenshot for support, remove the credential first. A masked field in the app helps reduce accidental display, but it does not make other copies safe.

Use the access and expiry settings appropriate to your account and project. If a credential is exposed or no longer needed, manage or revoke it through Figma. Do not include the full token when asking for help with a failed import.

How Swelik uses the credential

In the current implementation, Swelik sends the token server-side to Figma for the requested file or export operation. It is not saved in the project database, and the client preview does not need it. The token is not forwarded to the export-storage host when the resulting file is downloaded.

This is a personal-token workflow, not OAuth sign-in or an ongoing synchronization connection. You provide a credential when you perform the import. If your organization does not permit this workflow, use an approved manual export rather than changing policy merely to complete the import.

Figma recommends OAuth for applications acting on behalf of individual users. Swelik's current interface should therefore not be described as a one-click Figma account connection. The distinction matters when deciding whether the feature fits your team's access requirements.

Keep the public and management links separate

After creating the preview, send only the public URL to reviewers. It presents the imported artifact without providing the editable source file. Include review instructions and a revision label so the client knows what the link represents.

Save the management URL privately. Anyone possessing it may be able to change or delete the Swelik project. It is not a more convenient version of the client link, and it should not appear in a public article or shared screenshot.

An unlisted public preview is also not the same as an authenticated private workspace. Anyone who obtains the public URL may be able to view the design. Decide whether that access model is appropriate before importing sensitive material.

Diagnose access failures before repeating the request

If loading frames fails, check that the design link points to a supported Figma file, the account can access it and the token has the relevant read permission. Verify that the credential has not expired or been revoked.

If frames load successfully but export fails, do not immediately assume that the token is wrong. Rendering is a separate operation and may fail because of a transient connection issue, a service limit or the selected frame. Use the import troubleshooting guide to narrow the stage.

When contacting support, provide the step that failed, the exact user-visible message and a safe diagnostic code if available. Do not paste the token or a signed export URL into the report. Those details are not necessary to explain which stage failed.

Choose the manual route when it fits better

You can export the selected frame as PDF in Figma and use Upload file in Swelik. This avoids submitting an API credential to Swelik and may fit a client's internal approval process better. Inspect the PDF before publishing it, just as you would inspect an API-generated export.

The manual route still creates a design preview and can support later replacements through the management page. It is a valid workflow, not a requirement to abandon the project if token-based import is unavailable.

Frequently asked questions

Is my Figma token the same as my Swelik management link?

No. The token authorizes a Figma API operation. The management link authorizes changes to one Swelik preview. Keep both private, but use each only for its intended purpose.

Can I send the token to a client so they can open the preview?

No token is needed for the public Swelik preview. Send the public URL and keep the credential separate.

Does revoking a token remove an already imported preview?

The imported artifact is stored separately in Swelik. Manage or delete that preview using its private management link. Revoking a Figma token prevents future use of that credential; it is not the same operation as deleting an exported copy.