Figma Plugin ↔ GitHub REST API: Unresolved OAuth Scope Negotiation Across Figma Updates

Goal

Ensure that a Figma plugin can maintain valid OAuth scopes when Figma releases update the Plugin API, without breaking existing design files.

Constraints & Uncertainty

Figma’s Plugin API currently stores the GitHub access token in local storage and refreshes it automatically, but the documentation does not specify how to detect a scope mismatch after an API update. Plugin authors must decide whether to re‑authenticate automatically, prompt the user, or rely on a fallback scope. Additionally, backward‑compatibility demands that older plugin releases continue to function until the user explicitly updates the plugin.

Unresolved Decision

What strategy should plugins adopt to negotiate and persist OAuth scopes across Figma updates while preserving backward compatibility?

Specific Questions

• Does Figma provide a runtime hook or metadata endpoint to detect when the required scopes have changed?
• Should plugins request the minimal set of scopes initially and then request additional scopes on demand, or is a single comprehensive scope set preferred?
• What is the recommended pattern for storing and refreshing scopes so that older plugin releases remain functional after a Figma update?