Data and storage
Where your tokens actually live, what travels with the file, and what does not.
What is stored where
| Data | Location | Travels with the file? |
|---|---|---|
| Tokens, themes, token sets | Plugin data on the Figma document | ✅ Yes |
| Layer bindings | Shared plugin data on each layer | ✅ Yes |
| Last applied token per layer | Plugin data on the layer | ✅ Yes |
| Sync providers and access tokens | Figma client storage, per file key | ❌ No — local to your machine |
| Appearance setting | Client storage, per file key | ❌ No |
| Plugin window size | Client storage, per file key | ❌ No |
The important consequence: duplicating or sharing a Figma file carries the whole token system with it, including layer bindings. Anyone opening the file with the plugin sees the same tokens.
Repository connections do not travel. A collaborator has to add the provider and their own access token themselves.
Document storage
The token document is JSON, split into chunks of 90,000 characters and written across several plugin-data keys, because Figma limits the size of any single entry.
Chunking is transparent — there is no user-visible size setting. Figma’s overall plugin-data quota still applies to very large documents.
If the stored data cannot be parsed, the plugin warns “Failed to parse chunked data” and starts from empty rather than crashing. Keep an exported backup of anything you cannot afford to lose.
A legacy storage location in client storage is migrated into document storage automatically on first load.
Bindings on layers
Applying a token writes a record onto the layer keyed by token type, so a layer can carry a colour binding and a dimension binding at the same time.
Bindings are what Inspect reads and what Sync to selection replays.
Security note on access tokens
Personal access tokens for GitHub and GitLab, and any HTTP Authorization
header value, are stored as plain JSON in Figma’s client storage — not
encrypted, not in a keychain.
Practical guidance:
- Use a token scoped to the single repository, not an account-wide one.
- Prefer a short expiry and rotate it.
- On a shared or managed machine, treat the token as exposed.
Backups
There is no undo for token operations. The undo/redo buttons in the header are not functional.
The reliable backup is an export. Do one before:
- Saving in the JSON editor — that replaces the document
- Pulling from a sync provider — that replaces local tokens
- Deleting a token set — that deletes every token in it
Starting over
There is no reachable “reset plugin” button in the current UI. To clear a document manually:
- Open the JSON editor.
- Replace the contents with
{ "$version": "2025.10", "tokens": {} }. - save json.
- Delete any remaining token sets from the tree.
Layer bindings survive this — remove them per selection from the Inspect tab.