Is it safe to authorize a Figma plugin for Google Drive?

what does "access to Google Drive" actually mean?

When a Figma plugin requests Google Drive access, it's asking for an OAuth 2.0 token — a scoped credential issued by Google, not a password. The plugin never sees your Google login details. Google handles authentication entirely, then returns a token that grants the plugin specific, limited permissions you can see before approving.

The scope of that token depends on what the plugin requests. A well-built plugin requests only what it needs. ExportHub, for example, requests access scoped to files it creates — meaning it can write new files to Drive but cannot read, modify, or delete files it didn't create. That's a meaningful technical constraint, not marketing copy.

The permission screen Google shows you isn't decorative. Read it. The listed scopes are legally binding constraints on what the token allows. If a plugin's screen says it can read all your Drive files and the plugin has no reason to do that, that's a red flag worth acting on.

what scopes should a Figma export plugin request?

For a plugin whose only job is exporting assets to Drive, the appropriate scope is drive.file. This scope limits the plugin to files it created itself — it cannot browse your Drive, read existing files, or access anything outside its own exports.

Broader scopes like drive or drive.readonly grant access to everything in your Drive. A plugin that only exports assets has no legitimate reason to request those. If you see them, the plugin is either poorly scoped or collecting more access than the feature requires.

You can check exactly what scopes a plugin requested after authorization. Go to myaccount.google.com/permissions, find the app, and review what it was granted. Revoke access there at any time.

does the plugin store your Google credentials?

No reputable plugin stores your Google password — that's not how OAuth works. What a plugin may store is the access token or refresh token Google issues after you authorize. Where and how that token is stored matters.

Tokens stored only in your browser's local storage or Figma's plugin storage never leave your device. Tokens sent to a third-party backend server are a different story — you're trusting that server's security posture. Check the plugin's privacy policy for explicit language about token handling. If there's no privacy policy, that's a meaningful gap.

ExportHub stores tokens locally. No credentials are transmitted to or stored on Nullab servers. The plugin communicates directly between your Figma session and Google's APIs.

how do you verify a Figma plugin is trustworthy before authorizing?

Five things worth checking before you click allow:

• Publisher identity. Is the plugin published by a named individual or company with a verifiable presence? Anonymous publishers with no website or documentation are higher risk.
• OAuth scopes on the permission screen. Match what's requested against what the plugin actually does. Export-only plugins need drive.file, not full Drive access.
• Privacy policy. Does one exist? Does it address token storage and data handling explicitly? Vague or absent policies are a signal.
• Open source code. Plugins with public source code can be audited. If the code is closed, you're trusting the publisher's claims.
• Figma Community reviews and install count. Not a security guarantee, but volume and feedback patterns can surface red flags others have noticed.

can you limit what a Figma plugin can access after authorizing?

Yes. Google's permissions management page gives you full control. At myaccount.google.com/permissions, you can see every third-party app with access to your Google account and revoke any of them with one click. Revoking invalidates the token immediately — the plugin loses access until you re-authorize.

If you authorized a plugin, used it once, and don't plan to use it again, revoking access is a reasonable hygiene step. It costs nothing and limits your exposure surface.

For ongoing use, check that list periodically. Old plugins you no longer use may still hold active tokens.

what happens to your files after export?

Once a file lands in Google Drive, it follows Google's standard security model — your account permissions, sharing settings, and Drive encryption apply. The plugin's access ends at the moment of upload. It cannot modify, move, or delete the file after it's been created, assuming the plugin is scoped to drive.file.

Files are not routed through any intermediate server in a properly built plugin. The export goes from Figma directly to Google's API. If a plugin's architecture routes files through its own server before uploading to Drive, that should be disclosed in its privacy policy — and is worth scrutinising.

For teams with strict data governance requirements, confirm the plugin's data flow before deploying it across your org. Most enterprise Google Workspace admins can also restrict which third-party apps users are permitted to authorize.

is ExportHub safe to authorize?

ExportHub requests drive.file scope only. It cannot read or access any existing file in your Drive. Authorization is handled entirely by Google's OAuth flow — ExportHub never receives or stores your password. Tokens are stored in Figma's local plugin storage and are not transmitted to Nullab servers.

The plugin is built and maintained by Nullab, a registered UK company. The privacy policy addresses token handling explicitly. If you've reviewed the OAuth screen, verified the scopes, and read the policy, you have everything you need to make an informed call.

For a full walkthrough of how the OAuth connection works technically, see Connect a Figma plugin to Google Drive: OAuth and folders.