Set up enterprise-managed authorization for Figma MCP

Normally, the Figma MCP server requires each user to follow an OAuth login flow to get access. With enterprise-managed authorization, admins can manage this access centrally, so members don't each have to sign in and authorize the Figma connector on their own.

You can set up enterprise-managed authorization in two ways:

• Okta Cross App Access (XAA): Manage access through Okta, so members sign in once through your identity provider.
• Claude auto-connect (beta): Connect members with matching Figma accounts automatically through Claude. You can use this option even if your identity provider doesn't support enterprise-managed authorization. Figma still requires SAML SSO to be configured for your organization.

Set up with Okta Cross App Access (XAA)

To set up enterprise-managed authorization with Okta XAA:

1. Set up SAML SSO with Okta for your organization.
2. Follow Okta's guide to set up enterprise-managed auth.
3. In Figma, from the file browser, click Admin.
4. Select Settings in the left sidebar.
5. In the Login and provisioning section, click Enterprise-managed authorization for MCP.
6. Enter your Okta base tenant URL.
7. Click Save.

Set up Claude auto-connect (beta)

Claude auto-connect, also called Claude-issued enterprise-managed auth, lets members with matching Figma accounts connect to Figma MCP in Claude without individual sign-in or consent prompts.

Before you start, make sure:

• You have a Claude Team or Enterprise plan.
• You have admin access in Claude and organization admin access in Figma. One person can have both roles.
• SAML SSO is configured for your Figma organization.
• Your organization has a verified email domain in Figma.
• Each member who will use auto-connect has matching email addresses in Claude and Figma.

Use Express setup

Express setup registers Claude's issuer URL in Figma automatically, so you don't need to copy it between apps.

1. In Claude, go to Organization settings > Connectors and select the official Figma connector.
2. Next to Managed authorization, click Set up.
3. In the Connect step, under Identity source, select Claude-issued.
4. Click Connect Figma and approve the request in Figma.
5. Back in Claude, click Run test and confirm that every check passes.
6. Click Enable and continue, then choose who can use the connector.

Set up manually

You can also register Claude's issuer URL manually in your Figma organization settings.

1. In Claude, go to Organization settings > Connectors and select Figma.
2. Next to Managed authorization, click Set up.
3. In the Connect step, under Identity source, select Claude-issued.
4. Expand Set up manually, if shown, and copy the Issuer URL. This URL is unique to your Claude organization.
5. In Figma, from the file browser, click Admin.
6. Select Settings in the left sidebar.
7. In the Login and provisioning section, click Enterprise-managed authorization for MCP.
8. Paste the issuer URL you copied from Claude and click Save.
9. Back in Claude, click Run test and confirm that every check passes.
10. Click Enable and continue, then choose who can use the connector.

Troubleshoot setup

If Claude's connection test fails, check that SAML SSO is configured for your Figma organization, your email domain is verified in Figma, and your email addresses match in Claude and Figma.

Saving the issuer URL successfully doesn't confirm that the connection is working. An unverified email domain can prevent the connection from working even after the issuer URL has been saved.