Everything that works with FISYCO outside your browser tab acts as you: a script with a personal access token, the Figma plugin, an AI agent. This page shows how each one signs in, what it is allowed to do, and how to end its access. It also covers the protection of your own sign-in: sign-in methods, passkeys and two-factor authentication.
Where to find it
Open the account menu and choose Account settings. Four pages matter here:
- Access Tokens: personal tokens for scripts, CI and agents.
- Sessions: every device and tool currently signed in to your account.
- Authentication: sign-in methods, two-factor authentication and passkeys.
- AI agents: agents you allowed to sign in through the browser.
Personal access tokens
A personal access token lets a script, a CI job or an agent call the FISYCO API without a browser. The token acts as you, with your roles in each workspace and project. Its scopes can only narrow that access, never widen it. If your role does not let you delete a library, a token with every scope still cannot.
Create a token
- Open Access Tokens and click Create token.
- Fill in Token name. Name the tool and the machine, so you can tell tokens apart later.
- Under Scopes, tick only what the tool needs. The table below explains each one.
- Pick an Expiration: 30 days, 90 days, 6 months or No expiration. The dialog starts at 90 days.
- Click Create token.
FISYCO shows the token once, with a copy button and a ready config for an MCP client. Copy it, then click Done.
FISYCO stores only a fingerprint of the token, so nobody can show it to you again. If you lose it, revoke it and create a new one.
Send the token in the Authorization header:
Authorization: Bearer YOUR_TOKENScopes
The token list shows scopes by these names:
Workspaces, members and billing do not accept tokens at all, whatever the scopes. Agents in Claude Code, Cursor, VS Code and Windsurf can sign in through the browser and need no token: see Connect an AI agent.
Check and revoke tokens
Each token in the list shows its Scopes, when it was Last used and its Expiration. Revoke ends a token at once: the next request with it is rejected. An expired token stops working on its own.
Sign in with a code: the Figma plugin and agents
Some tools sign in with a short code instead of a token. The Figma plugin works this way.
- The tool shows a code like
ABCD-EFGHand opens the Connect a device page in your browser. - Sign in to FISYCO if you are not signed in yet.
- Type the code into User code and click Continue.
- Check what the page shows. The app says it is names the tool, and Access will be granted to names your account.
- Click Approve or Deny. The tool continues on its own.
A code works for 10 minutes. FISYCO never fills it in from a link: you type it yourself, so nobody can get your approval with a single click.
Approve only if you started the sign-in yourself, just now, on your own device. If someone sent you a code, deny it. The app's name is whatever the app chose to call itself.
What such a session can do
A session from code sign-in is limited to the design system tools. It can read libraries and components, start a sync, use the librarian and the MCP tools, and receive variables from the Figma plugin. It cannot create access tokens, change library settings or touch workspaces, members and billing. Agents you allowed through browser sign-in have the same limit.
Within these tools your roles still apply. To end such a session, revoke it under Sessions, click Disconnect in the plugin, or revoke the agent under Authorized agents on the AI agents page.
Sessions
Sessions & devices lists every active sign-in to your account, including the Figma plugin and agents. Each entry shows the browser and system, when you Signed in, when it Expires and its IP address. Your current browser is marked Current device.
- Revoke signs out one session right away.
- Revoke other sessions signs out everything except the browser you are using.
If you see a device you don't recognise, revoke it, then check your sign-in methods.
Sign-in methods, passkeys and two-factor
The Authentication page has three parts.
Sign-in methods
Connect Google, GitHub, GitLab or Bitbucket with Connect. For a connected service, Manage offers Manage in service, Re-authenticate and Disconnect. FISYCO won't let you disconnect your only way to sign in: connect another method first.
Two-factor authentication
- Click Enable 2FA.
- Scan the QR code with an authenticator app such as Google Authenticator.
- Enter the Authenticator code and click Confirm 2FA.
- Save the Recovery codes. Each one works once.
From then on, every sign-in asks for a code after the first step: email and password, a connected service, or a passkey. If your phone is not at hand, choose Use a recovery code on the sign-in screen. To turn two-factor off, enter an authenticator or recovery code and click Disable 2FA. The same code lets Regenerate recovery codes issue a fresh set.
Passkey
Enter a Passkey name and click Add passkey, then follow your system's prompt. After that, Sign in with passkey on the sign-in page uses the hardware key or biometrics. Remove deletes a passkey; other sign-in methods keep working.
Confirm it's you
Some changes ask you to prove it's you if you haven't signed in recently. These are adding or removing a passkey, disconnecting a service, turning off two-factor, adding an email and deleting the account. The Confirm your identity dialog asks for your Password or Authenticator code. An account with neither is asked to Sign in again.
Your roles decide what you, and so your tokens and agents, can do. They are explained in Workspace and team.