| name | webflow-security-basics |
| description | Apply Webflow API security best practices — token management, scope least privilege,
OAuth 2.0 secret rotation, webhook signature verification, and audit logging.
Use when securing API tokens, implementing least privilege access,
or auditing Webflow security configuration.
Trigger with phrases like "webflow security", "webflow secrets",
"secure webflow", "webflow API key security", "webflow token rotation".
|
| allowed-tools | Read, Write, Edit, Grep |
| version | 1.5.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","design","no-code","webflow"] |
| compatibility | Designed for Claude Code |
Webflow Security Basics
Overview
Security best practices for Webflow Data API v2 tokens, OAuth secrets, webhook
verification, and access control. Covers the full lifecycle from token creation
to rotation and revocation.
Prerequisites
- Webflow developer account at
developers.webflow.com
- Understanding of environment variables
- Secret management solution (vault, cloud secret manager, etc.)
Instructions
Step 1: Token Types and Selection
| Token Type | Scope | Best For |
|---|
| Workspace Token | All sites in workspace | Internal tools, scripts |
| Site Token | Single site only | Single-site integrations |
| OAuth Access Token | User-authorized scopes | Public apps, marketplace apps |
Rule: Never use a workspace token where a site token would suffice.
Step 2: Least Privilege Scopes
Only request scopes your integration actually needs:
| Operation | Minimum Scope |
|---|
| Read site info | sites:read |
| Publish site | sites:write |
| Read CMS content | cms:read |
| Create/update CMS items | cms:write |
| Read pages | pages:read |
| Read form submissions | forms:read |
| Read products/orders | ecommerce:read |
| Create products, fulfill orders | ecommerce:write |
const READ_ONLY_SCOPES = "sites:read cms:read pages:read forms:read";
= ;
= ;
