webflow-security-basics

name	webflow-security-basics
description	Apply Webflow API security best practices — token management, scope least privilege, OAuth 2.0 secret rotation, webhook signature verification, and audit logging. Use when securing API tokens, implementing least privilege access, or auditing Webflow security configuration. Trigger with phrases like "webflow security", "webflow secrets", "secure webflow", "webflow API key security", "webflow token rotation".
allowed-tools	Read, Write, Edit, Grep
version	1.5.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","design","no-code","webflow"]
compatibility	Designed for Claude Code

Webflow Security Basics

Overview

Security best practices for Webflow Data API v2 tokens, OAuth secrets, webhook verification, and access control. Covers the full lifecycle from token creation to rotation and revocation.

Prerequisites

• Webflow developer account at developers.webflow.com
• Understanding of environment variables
• Secret management solution (vault, cloud secret manager, etc.)

Instructions

Step 1: Token Types and Selection

Token Type	Scope	Best For
Workspace Token	All sites in workspace	Internal tools, scripts
Site Token	Single site only	Single-site integrations
OAuth Access Token	User-authorized scopes	Public apps, marketplace apps

Rule: Never use a workspace token where a site token would suffice.

Step 2: Least Privilege Scopes

Only request scopes your integration actually needs:

Operation	Minimum Scope
Read site info	sites:read
Publish site	sites:write
Read CMS content	cms:read
Create/update CMS items	cms:write
Read pages	pages:read
Read form submissions	forms:read
Read products/orders	ecommerce:read
Create products, fulfill orders	ecommerce:write

// Example: Read-only integration needs only these scopes
const READ_ONLY_SCOPES = "sites:read cms:read pages:read forms:read";

// CMS sync integration
  = ;


  = ;