People: Company admins, team admins
Platforms: Browser, Desktop
The Figma integration lets users embed Figma files, frames, and sections in Miro boards. This guide covers the integration's technical implementation, security model, and data handling for admins evaluating or configuring the integration.
Key features
- Live embed: Users can embed Figma content into a Miro board as a live iframe.
- Secure: Every board visitor is prompted to log in to the iframe before they can view the embedded content.
- Display options: Users can choose to display embedded content as a live embed or as a bookmark.
- Focus mode: Users can expand a live embed or bookmark into focus mode to view it without distractions.
- Action shortcut: Users can add an action shortcut that opens a dialog for embedding a Figma link.
- Asset picker: Users can add a specific frame or section as a static image on the board, so collaborators can view and reference that exact content without needing access to the source file.
- Admin controls: Admins can prevent users from using the asset picker to add Figma content as static images.
Limitations
- The asset picker isn't available for slides.
- Editing isn't supported on live embeds.
Technical implementation
Miro integrates with Figma through the Figma REST API. Users authorize access with OAuth 2.0, then link their Figma files to a Miro board.
Security considerations
The integration's asset picker lets users attach part of a Figma file to the canvas as a static image. Only authorized users can access the live embed, but anyone with access to the board can view an attached static image. Adding assets from embeds is disabled by default on public boards.
Company admins can disable the asset picker for all boards:
- Go to Company settings > Apps and integrations > Apps > Figma (under the Manage apps tab).
- Toggle Prevent users from adding assets from embeds to the canvas.
Data flows
- A user who belongs to a team or organization with this feature enabled pastes a Figma link onto a Miro board.
- Miro reads the link. If the user hasn't authorized the integration yet, Miro starts the OAuth flow and redirects the user to Figma's authorization page.
- After the user grants authorization, Miro's integration service uses the user's access token to call the Figma REST API and retrieve the content.
- Once the content is on the board, everyone with access to the same board can see it. Reauthorization isn't required for 90 days, the validity period of the refresh token.
What Figma data Miro stores
Miro fetches and stores the following data from pasted Figma links:
- Images of visuals from frames and sections
- Titles of boards, designs, slides, decks, and prototypes
- Page names from Figma boards and designs
Data retention
Embedded data follows Miro's standard data retention policy for all customer data.
Authentication and authorization
Embedding a Figma link on a board requires the user to authorize the integration through Figma's OAuth consent screen. Depending on the customer's Figma configuration, this may also require a Figma admin to approve the integration.
Required authorization scopes
The Figma integration requires the following scope:
-
files:read— read files, projects, users, versions, comments, components and styles, and webhooks.
What's stored in Miro and how
Miro stores two categories of data for this integration: authorization data and unfurling data.
- Authorization data: Miro stores the access token and refresh token in its database for several days. While the authorization is active, Miro automatically refreshes an expired access token using the refresh token (valid by default for 90 days), without requiring the user to reauthorize. All data stored for this integration is encrypted at rest using 256-bit AES.
- Unfurling data: Miro stores two kinds of unfurling data: the images captured by the asset picker (stored as part of the board) and the titles and image references (stored encrypted in an internal service).
Revoking a token
Users can revoke the integration's access at any time from their Figma account:
- From the file browser, click the account menu in the top-left corner and select Settings.
- Scroll to the Personal access tokens section.
- From the list of personal access tokens, select the token you want to revoke.
- Click Revoke access.
The integration can no longer access your data through the API. To use the integration again later, generate a new personal access token and reconfigure the integration.
Set up the Figma integration
NOTE: Only Miro team admins can install the app. If your Miro organization only allows approved apps, and a regular user pastes a Figma link, that user sees an app install request dialog instead.
To install and start using the integration:
- Copy the Figma file URL.
- Paste the URL onto your Miro board.
- What happens next depends on who pasted the link:
- A Miro team admin pastes the link: The app is authorized and installed automatically, and the link unfurls without further action.
- A regular user pastes the link, and the organization only allows approved apps: An app install request dialog opens. After the user requests permission, company admins can follow the App request flow article to approve the request.
Connect a Figma account
After the integration is installed and authorized:
- Click Connect on the widget created after pasting the URL on the board. You're redirected to a page asking you to grant Miro access to your Figma account.
- Enter your account credentials if needed, then click Allow access. The Figma content is added to your board as an iframe.
Frequently asked questions
How do I turn off the integration?
- Go to Figma developer apps.
- Select the application.
- On the Embed API tab, delete the Allowed embed origins URL.
Which users can embed Figma content into Miro?
The user and the Miro board must meet both of these criteria:
- The user has authorized the Miro Figma integration.
- The user has access to the Figma content they're trying to embed.
Which users can view the embedded Figma content?
Anyone with access to the Miro board and permission from the owner of the embedded content — that is, anyone with view, comment, or edit permissions on the board. Viewers don't need to authorize the integration or hold a Figma license to view the embedded content on the board.
Do users have to reauthorize to paste links on other boards?
No, as long as the authorization is still valid (Miro treats an authorization as valid for a month after it's granted). Users can paste Figma links on any board, and the content imports normally.
If the board belongs to a different team or organization where this integration isn't enabled, the user can't use it there.
Can I access Figma content through Miro that I can't access directly in Figma?
No. You can only embed Figma content you already have access to — you can't use the integration to see something you couldn't otherwise open in Figma. That said, if someone with access has already embedded the content as a static image on a board you share with them, you can view that snapshot even without direct access to the source file. The integration doesn't enforce any additional access policies beyond this; use the Miro board's own sharing settings to restrict who can collaborate. Note that a static image snapshot can't be used to explore the underlying data, open the original file, or change filters.
Where can I find the Miro Data Processing Addendum?
See the Miro Data Processing Addendum.
What's disallowed on public Miro boards?
For security reasons, public boards disable:
- Asset extraction — supported by the Looker, Google Slides, Figma, Power BI, Microsoft Word, Microsoft Excel, and Microsoft PowerPoint integrations.
- Direct asset unfurling (asset instead of live embed) — supported by the Figma integration.
How can I restrict board access to the same people who have access to the source file?
The integration only manages file access from the source system (Figma), not from Miro. By default, this isn't enforced — to maintain this level of security, Miro organization admins must disable the asset picker in the app's admin settings (see Security considerations).
Disabling the asset picker prevents Figma content from being saved as static images on a Miro board, where it could later be seen by people who don't have access to it in Figma (for example, if the board is shared publicly or with people who lack source access).