Manage AI credit limits with SCIM: Okta Guide

Use Okta to manage individual paid AI credit limits in Figma. This guide uses a personal attribute to manage credit limits separately from your existing seat-assignment groups.

Overview

The aiCreditLimit attribute controls each person’s access to paid AI credits. In this guide, you’ll create a source attribute on the Okta user profile and map it to the Figma application attribute so Okta can send the person’s limit to Figma through SCIM.

For supported values, how inherited limits work, and how to stop managing a limit through SCIM, see Manage AI credit limits with SCIM.

To get started:

1. Check your existing SCIM connection.
2. Add a source attribute to the Okta user profile.
3. Add the AI credit limit attribute to the Figma application profile.
4. Map the attributes and enable updates.
5. Test the configuration in Figma.

1. Check your existing SCIM connection

First, check to make sure you have an existing SAML SSO and SCIM configuration for Figma in Okta.

To do so, check the following in Figma:

1. From the file browser, open Admin.
2. Click Settings.
3. In the Login and provisioning section, confirm that your existing Okta SAML and SCIM setup is connected to the organization you want to manage.

2. Add the source attribute to the Okta user profile

Next, you need to create a field on the Okta user profile to store each person’s paid AI credit policy.

1. In the Okta Admin Console, open Directory → Profile Editor.
2. Filter the profiles to Okta.
3. Open User (default), or the Okta user profile used by the people you want to manage.
4. Select Add Attribute.
5. Configure the attribute using the following settings.

6. Select Save.

If aiCreditLimitPolicy already exists, confirm its settings instead of creating a duplicate.

3. Add the attribute to the Figma application profile

Next, create the application attribute that Okta sends to Figma.

In Okta:

1. In Directory → Profile Editor, open your Figma application’s profile.
2. Select Add Attribute.
3. Configure the attribute using the following settings.

4. Select Save.

Use the complete external namespace shown in the table.

4. Map the attributes and enable updates

Next, you need to map the Okta source attribute to the Figma application attribute.

In Okta:

1. In the Figma application’s Profile Editor, open Mappings.
2. Select Okta User to Figma.
3. Find the destination attribute aiCreditLimit.
4. Enter user.aiCreditLimitPolicy as its source.
5. Open the mapping arrow menu and set the mapping to apply on user creation and updates.
6. Preview the mapping with your test user.
7. Select Save Mappings.

In Applications → your Figma application → Provisioning → To App, confirm that Update User Attributes is enabled.

5. Test the configuration

Start with a test user before applying policies to more people.

Set a test value in Okta

1. Open Directory → People.
2. Select your test user.
3. Open Profile → Edit.
4. Find Figma AI Credit Policy.
5. Enter blocked, without quotation marks.
6. Select Save.
7. Confirm the saved profile shows blocked.

Confirm that provisioning completes without an error. If an update fails, check the application’s provisioning tasks or the Okta System Log.

Verify the result in Figma

1. From the file browser, select Admin.
2. Select the People tab.
3. Find the test user by email.
4. Check the Paid AI credit access column. The user should show No access with a lock.
5. Hover over the access value or lock. The message should read: “This user’s AI credit limit is provisioned by your IdP.”

Confirm that the person’s seat, workspace, billing group, and other managed attributes still match their expected configuration.

Blocking paid-credit use doesn’t remove the credits included with the person’s seat.

Test other credit policies

Update the same test user’s Figma AI Credit Policy in Okta and verify each result in Figma:

Restore the test user’s agreed final policy when you finish testing.

For supported values and the order of inherited defaults, see Manage AI credit limits with SCIM.

Troubleshoot provisioning updates

If the expected limit doesn’t appear in Figma:

• Check the application’s provisioning tasks or Okta System Log for an error.
• Confirm that the source variable is aiCreditLimitPolicy and the mapping uses user.aiCreditLimitPolicy.
• Check that the external name and namespace match the configuration table exactly, without trailing spaces.
• Confirm that Update User Attributes is enabled.
• Confirm that you’re viewing the same organization connected to the Okta application.