Webflow
Connect Webflow to use the Data API and start workflows from signed site events.
What your agents can do
Agents can search and call Webflow's Data API v2 and beta endpoints to manage CMS items, pages, assets, forms, ecommerce and site settings. Enterprise, analytics, workspace and beta features depend on your Webflow plan and permissions. Agents use curl for uploads and downloads through storage URLs returned by the API.
Authentication
Webflow site API token
In Webflow, open Site settings > Apps & integrations > API access, generate a token and select the permissions your workflows need. Choose Webflow site API token in Helios and enter Site API token. Helios checks the bearer token with GET /token/introspect.
A site administrator must create the token. Enable sites:read and sites:write for webhook setup, plus the event read scopes below. Site tokens cannot use custom-code endpoints. Tokens expire after 365 consecutive inactive days; replace a revoked or expired token in Helios. See the site-token guide.
Your own Webflow app
Create a Data Client app under your workspace's Apps & integrations > App Development settings. Register the callback URL shown in Helios, ending in /integrations/webflow/oauth_callback. Choose Your own Webflow app, enter Client ID and Client secret, then authorize the sites or workspace you want to connect.
Configure all 38 scopes below in your app settings before authorizing. Webflow rejects an authorization URL that requests a scope missing from the app configuration. Workspace access requires an app registered for workspace access. New apps are restricted to their own workspace unless Webflow approves external installation. See app registration and OAuth authorization.
| Resource | Scopes |
|---|---|
| Assets | assets:read, assets:write |
| Authorized user | authorized_user:read |
| CMS | cms:read, cms:write |
| Comments | comments:read, comments:write |
| Components | components:read, components:write |
| Custom code | custom_code:read, custom_code:write |
| Ecommerce | ecommerce:read, ecommerce:write |
| Forms | forms:read, forms:write |
| Pages | pages:read, pages:write |
| Branches | branches:read, branches:create, branches:delete, branches:update, branches:merge, branches:publish |
| Sites | sites:read, sites:write |
| Site activity | site_activity:read |
| Site plans | site_plans:read, site_plans:write |
| Site configuration | site_config:read, site_config:write |
| Workspace | workspace:read, workspace:write, workspace_activity:read |
| Site membership | site_access:read, site_access:write |
| Workspace membership | workspace_members:read, workspace_members:write |
| App subscriptions | app_subscriptions:read |
Webflow does not label individual scopes as admin-only. Enterprise and workspace restrictions still apply. Retired users:read and users:write scopes are excluded. The OAuth guide documents no refresh grant, so Helios does not schedule token refreshes. Reauthorize if Webflow revokes or rejects the token.
Triggers
Helios creates one signed webhook per event on every site the token can access. No dashboard configuration is needed. Webflow supports these 17 events:
| Helios events | Useful filters | Event read scope |
|---|---|---|
form.submitted | Site ID, Form ID, Form name, Locale ID | forms:read |
site.published | Site ID, Domain, Publish scope, Page ID | sites:read |
page.created, page.metadata_updated, page.deleted | Site ID, Page ID, Page name, Published path | pages:read |
collection_item.created, collection_item.updated, collection_item.deleted, collection_item.published, collection_item.unpublished | Site ID, Collection ID, Item ID, CMS locale ID, Slug | cms:read |
order.created, order.updated | Order ID, Order status, Customer email, Payment processor | ecommerce:read |
inventory.updated | SKU ID, Inventory type | ecommerce:read |
comment.created | Site ID, Page ID, Thread ID, Comment type, Author email | comments:read |
branch.created, branch.merged, branch.deleted | Site ID, Branch ID, Page ID, Parent page ID, Page name | branches:read |
Name filters match text without case sensitivity. ID and slug filters accept patterns such as prefix*. Email and domain patterns ignore case. Leaving a filter empty accepts every value; a selected filter cannot match a missing payload field. Orders and inventory have no Site ID filter because Webflow does not document that field in those payloads.
A branch merge triggers branch.merged, including its automatic branch deletion, but does not also trigger branch.deleted. Comments can arrive up to five minutes after creation. User Accounts events were retired and are excluded. See the event reference.
Webhook security and setup
API-created site-token webhooks return individual signing keys, which Helios stores encrypted. OAuth webhooks use your app's client secret. Helios verifies x-webflow-signature against the timestamp and full request body, and rejects timestamps outside a five-minute window. Dashboard-created webhooks are unsigned and cannot be used for this connection.
Setup reuses existing subscriptions at the connection's URL. When a webhook needs replacement, Helios creates the new subscription and saves its key before removing the old one. A refused replacement leaves the existing webhook intact. Plan or scope restrictions appear as unavailable events only when no retained or newly created subscription delivers that event. An event may still be available on one site when another site refuses it. A retained form-name-filtered webhook continues delivering only that form if its replacement fails.
Webflow documents no universal delivery ID. Helios uses submission IDs, comment IDs and collection item IDs with their last-updated time and locale to recognize retries. Other events use a body fingerprint without the signed send timestamp. For those events, identical legitimate states can collide, and changed field ordering between retries can prevent deduplication. Webflow delivers one event per request; batch envelopes are unsupported.
Limits and errors
Webflow allows 75 webhooks per trigger type per site. Successful delivery requires HTTP 200. Failures are retried three times at ten-minute intervals; repeated failures can deactivate a webhook. Contact Webflow support for reactivation. See webhook signing and delivery.
Missing permissions or plan features can return 403. Add the scopes your workflow requires or use an eligible Webflow plan. If OAuth returns an invalid-scope error, check all requested scopes in the app settings. API rate limits vary by plan, and site publishing allows one successful publish per minute. See rate limits.
Last updated on