What to check
- □Is the Figma Personal Access Token configured in credential-brokers? (The skill will fail with an auth error if the credential is absent or expired.)
- □Does the token have read access to the target file? (Figma tokens can be scoped — a viewer token cannot post comments.)
- □Is the file URL or file key correct — not a prototype link or a community file the token can't reach?
- □If posting comments: does the token have edit access to the target file?
What good looks like
A valid token in credential-brokers, confirmed against the correct scope, and a file key the agent can resolve.
What bad looks like
A token that worked on a different file but is scoped to a team the current file is not in. Or a prototype share link where the agent needs the original file link. Or a token that expired since the last session.
Consequence of skipping
Figma API errors are opaque — 'access denied' doesn't tell you whether the token is invalid, expired, or scoped incorrectly. Confirming the credential before the session starts avoids a mid-session block that requires you to interrupt, reconfigure, and restart.