Webflow

Overview

Connect your users to Webflow for website management, CMS collections, page content, forms, and ecommerce data.

Property	Value
Provider ID	webflow
Category	Design
PKCE	Not supported
Token refresh	Not supported (permanent tokens)
Redirect URI	Shown in Developer Portal

Step 1: Create a Webflow OAuth App

Open the Webflow workspace

Sign in to webflow.com/dashboard as a workspace Admin (only workspace admins can create apps and view client secrets).

Open Apps & Integrations

Go to Workspace Settings → Apps & Integrations → App Development and click Create an App.

Fill in app details and enable Data Client

Enter Name, Description, Homepage URL (HTTPS), and Icon. Enable the Data Client capability so the app can use OAuth.

Configure the redirect URI

Add the Alter callback URL from the Developer Portal to the Redirect URI field (must be HTTPS) and select the required scopes.

Get credentials

Copy the Client ID and Client Secret.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Webflow provider

Go to OAuth Providers > Add Provider > Webflow.

Enter credentials

• Client ID: Paste your Webflow Client ID
• Client Secret: Paste your Webflow Client Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
sites:read	Read access to Webflow sites
sites:write	Create and modify Webflow sites
pages:read	Read access to Webflow pages
pages:write	Create and modify Webflow pages
collections:read	Read access to CMS collections
collections:write	Create and modify CMS collections
forms:read	Read form submissions
ecommerce:read	Read ecommerce data including orders and products
ecommerce:write	Manage ecommerce products and orders
assets:read	Read access to site assets
assets:write	Upload and manage site assets
authorized_user:read	Read the authorized user’s basic profile (id, email, name)

Notes

• Webflow tokens do not expire. There is no refresh token flow.
• See the Webflow OAuth authorization documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
assets/list	read	GET	/v2/sites/{site_id}/assets
assets/upload	write	POST	/v2/sites/{site_id}/assets
collections/create	write	POST	/v2/sites/{site_id}/collections
collections/get	read	GET	/v2/collections/{collection_id}
collections/items/create	write	POST	/v2/collections/{collection_id}/items
collections/items/delete	delete	DELETE	/v2/collections/{collection_id}/items/{item_id}
collections/items/get	read	GET	/v2/collections/{collection_id}/items/{item_id}
collections/items/list	read	GET	/v2/collections/{collection_id}/items
collections/items/publish	write	POST	/v2/collections/{collection_id}/items/publish
collections/items/update	write	PATCH	/v2/collections/{collection_id}/items/{item_id}
collections/list	read	GET	/v2/sites/{site_id}/collections
forms/list	read	GET	/v2/sites/{site_id}/forms
forms/submissions/list	read	GET	/v2/forms/{form_id}/submissions
inventory/get	read	GET	/v2/collections/{sku_collection_id}/items/{sku_id}/inventory
inventory/update	write	PATCH	/v2/collections/{sku_collection_id}/items/{sku_id}/inventory
orders/fulfill	send, write	POST	/v2/sites/{site_id}/orders/{order_id}/fulfill
orders/get	read	GET	/v2/sites/{site_id}/orders/{order_id}
orders/list	read	GET	/v2/sites/{site_id}/orders
pages/dom/get	read	GET	/v2/pages/{page_id}/dom
pages/dom/update	write	POST	/v2/pages/{page_id}/dom
pages/get	read	GET	/v2/pages/{page_id}
pages/list	read	GET	/v2/sites/{site_id}/pages
products/create	write	POST	/v2/sites/{site_id}/products
products/list	read	GET	/v2/sites/{site_id}/products
sites/custom-domains	read	GET	/v2/sites/{site_id}/custom_domains
sites/get	read	GET	/v2/sites/{site_id}
sites/list	read	GET	/v2/sites
sites/publish	write	POST	/v2/sites/{site_id}/publish
token/authorized-by	read	GET	/v2/token/authorized_by
token/introspect	read	GET	/v2/token/introspect
webhooks/create	admin	POST	/v2/sites/{site_id}/webhooks
webhooks/delete	admin, delete	DELETE	/v2/webhooks/{webhook_id}
webhooks/list	read	GET	/v2/sites/{site_id}/webhooks