What is OAuth?

In the world of systems integration, OAuth is a protocol for authenticating system so that they can securely connect in a specific and controlled way.

In Webflow, OAuth is integral to generating Webflow access tokens.

The UX that OAuth enables is that you can;

1. Trigger authentication from a 3rd party application
2. Choose the Webflow workspaces and sites you wish to allow access to
3. Approve the authentication

In that setup, Webflow automatically generates the requested Access Token, so that the application you are using has the access you’ve requested.

More importantly, OAuth is the only route wherein you can generate Access Tokens that are correctly scoped to our readonly permissions, and which can be generated for guest-invited client workspaces. Both of these are essential for Agencies and Freelancers developers who work with client Webflow sites.

This mechanism is gated by Webflow’s app store, which means that only application which appear in the Webflow app store can utilize the OAuth mechanic successfully. In the absence of that, users are required to manually generate the tokens they require.

WFAPI & Webflow OAuth

WFAPI has a full OAuth support built in through its wfapi login command. This includes a secure key-exchange server to protect Webflow’s app secret key, which is integral to the OAuth process.

However, Webflow has been unable to approve WFAPI for the app store.

The reality is that the current app store is oriented entirely towards Designer-facing apps, and not Developer-facing apps. A developer-oriented tool doesn’t have a category in the Appstore and in particular for a CLI, Webflow is unwilling to add it alongside other Designer-facing apps.

While we understand the problem, it presents a bigger problem for developers who need improved DX (developer experience) when working with Webflow.

Our hope is that Webflow will create a category for Developer-facing apps and support its developer community as fully as it can.

Current Workarounds

• Site-specific tokens can be manually generated for your own workspace, or for client workspaces where you have been invited as a guest, from the dashboard.
  • However this will only allow searching of an individual site.
• Workspace-specific tokens can be generated as Developer tokens from the API documentation “try it” page.
  • These can provide full workspace access, but are not scoped to readonly.

Webflow’s Statement

As of Nov 2025, Webflow has provided the following statement regarding OAuth access for developer-facing apps.

Thank you for the clarification and for your thoughtful note — we really appreciate your understanding and the work you’ve put into Sygnal Developer CLI.

While Sygnal Developer CLI is a strong developer tool, it currently falls outside the scope of what qualifies as a Marketplace app, and we don’t have a mechanism to enable OAuth for non-listed tools. At this time, we’re unable to accommodate OAuth access without an approved Marketplace listing, as Marketplace OAuth tokens are tightly managed through the app registration and listing process.

Developer-focused tools like this are absolutely on our radar, and we recognize the value they bring to the Webflow ecosystem. That said, these types of utilities would still need to meet certain Marketplace standards and go through a formal framework once developer-oriented listings or API access options are introduced.

We don’t yet have a defined timeline for when this type of developer-focused access might become available, but your feedback helps inform our roadmap moving forward.

Thank you again for your contribution and for building tools that enhance the developer experience around Webflow — we truly appreciate your effort and innovation.

Best regards, The Webflow Marketplace Team