Webflow

Overview

Connect your users to Webflow for website management, CMS collections, page content, forms, and ecommerce data.

Property	Value
Provider ID	webflow
Category	Design
PKCE	Not supported
Token refresh	Not supported (tokens do not expire)
Redirect URI	Shown in Developer Portal

Step 1: Create a Webflow OAuth App

Open the Webflow workspace

Sign in to webflow.com/dashboard as a workspace Admin (only workspace admins can create apps and view client secrets).

Open Apps & Integrations

Go to Workspace Settings → Apps & Integrations → App Development and click Create an App.

Fill in app details and enable Data Client

Enter Name, Description, Homepage URL (HTTPS), and Icon. Enable the Data Client capability so the app can use OAuth.

Configure the redirect URI

Add the Alter callback URL from the Developer Portal to the Redirect URI field (must be HTTPS) and select the required scopes.

Get credentials

Copy the Client ID and Client Secret.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Webflow provider

Go to OAuth Providers > Add Provider > Webflow.

Enter credentials

• Client ID: Paste your Webflow Client ID
• Client Secret: Paste your Webflow Client Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
sites:read	Read access to Webflow sites
sites:write	Create and modify Webflow sites
pages:read	Read access to Webflow pages
pages:write	Create and modify Webflow pages
cms:read	Read CMS collections and items
cms:write	Create and modify CMS collections and items
forms:read	Read forms and form submissions
forms:write	Modify form submissions
comments:read	Read comment threads on a site
comments:write	Create and modify comment threads on a site
components:read	Read a site’s components
components:write	Modify a site’s components
custom_code:read	Read registered scripts and custom code (Data Client apps only)
custom_code:write	Register and apply scripts and custom code (Data Client apps only)
site_activity:read	Read a site’s activity log
site_config:read	Read site configuration such as robots.txt and redirects
site_config:write	Modify site configuration such as robots.txt and redirects
users:read	Read a site’s Memberships users and access groups
users:write	Invite, update and delete a site’s Memberships users
workspace:read	Read workspace details
workspace:write	Modify workspace details
ecommerce:read	Read ecommerce data including orders and products
ecommerce:write	Manage ecommerce products and orders
assets:read	Read access to site assets
assets:write	Upload and manage site assets
authorized_user:read	Read the authorized user’s basic profile (id, email, name)

Notes

• Webflow access tokens have no documented expiry time and there is no refresh token flow.
• See the Webflow OAuth authorization documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
assets/list	read	GET	/v2/sites/{site_id}/assets
assets/upload	write	POST	/v2/sites/{site_id}/assets
collections/create	write	POST	/v2/sites/{site_id}/collections
collections/get	read	GET	/v2/collections/{collection_id}
collections/items/create	write	POST	/v2/collections/{collection_id}/items
collections/items/delete	delete	DELETE	/v2/collections/{collection_id}/items/{item_id}
collections/items/get	read	GET	/v2/collections/{collection_id}/items/{item_id}
collections/items/list	read	GET	/v2/collections/{collection_id}/items
collections/items/publish	write	POST	/v2/collections/{collection_id}/items/publish
collections/items/update	write	PATCH	/v2/collections/{collection_id}/items/{item_id}
collections/list	read	GET	/v2/sites/{site_id}/collections
forms/list	read	GET	/v2/sites/{site_id}/forms
forms/submissions/list	read	GET	/v2/forms/{form_id}/submissions
inventory/get	read	GET	/v2/collections/{sku_collection_id}/items/{sku_id}/inventory
inventory/update	write	PATCH	/v2/collections/{sku_collection_id}/items/{sku_id}/inventory
orders/fulfill	send, write	POST	/v2/sites/{site_id}/orders/{order_id}/fulfill
orders/get	read	GET	/v2/sites/{site_id}/orders/{order_id}
orders/list	read	GET	/v2/sites/{site_id}/orders
pages/dom/get	read	GET	/v2/pages/{page_id}/dom
pages/dom/update	write	POST	/v2/pages/{page_id}/dom
pages/get	read	GET	/v2/pages/{page_id}
pages/list	read	GET	/v2/sites/{site_id}/pages
products/create	write	POST	/v2/sites/{site_id}/products
products/list	read	GET	/v2/sites/{site_id}/products
sites/custom-domains	read	GET	/v2/sites/{site_id}/custom_domains
sites/get	read	GET	/v2/sites/{site_id}
sites/list	read	GET	/v2/sites
sites/publish	write	POST	/v2/sites/{site_id}/publish
token/authorized-by	read	GET	/v2/token/authorized_by
token/introspect	read	GET	/v2/token/introspect
webhooks/create	admin	POST	/v2/sites/{site_id}/webhooks
webhooks/delete	admin, delete	DELETE	/v2/webhooks/{webhook_id}
webhooks/list	read	GET	/v2/sites/{site_id}/webhooks