This tutorial guides you through setting up an OAuth 2.0 authentication flow. This flow allows users to grant limited permissions to your App and enables your App to request an access token to perform actions on behalf of the user.

By the end of this tutorial, your Webflow App will be able to obtain an access token on behalf of a user using the Authorization Code Grant flow.

Authorization Code Grant Flow

Webflow uses the Authorization Code Grant flow to provide access tokens to Apps. This flow involves a series of interactions between Webflow’s authorization server and your web app. Here’s how the process works when a user visits your site for the first time:

  1. User sign-up/Login: A user signs up or logs in to your App. At some point, they may need to perform an action that requires using the Webflow API.
  2. Authorization request: To make requests to the Webflow API on the user’s behalf, your App redirects the user to an authorization screen. Here, they can review the permissions your App is requesting and authorize access to specific Webflow Sites or a Workspace.
  3. User authorization: Once the user grants authorization, Webflow redirects them back to your App via a redirect URI specified during the app setup, adding a code parameter to the query string.
  4. Token Request: Your app uses the code to make a secure request to Webflow’s authorization server to obtain an access token. If the request is valid, Webflow responds with an access token.
  5. API Requests: Your app can now use this access token to make requests to the Webflow API on behalf of the user.


Get an access token

Requirements

Before you begin, ensure you have the following:

  • A Webflow App created with the “Data Client” building block. Learn more here
  • Your app’s client credentials: client_id and client_secret.

    Note: Only workspace administrators are authorized to view a client secret. If you’re not a site administrator, please contact one to get the secret for you.

Revoke an access token

To revoke an access token that has been issued to your application, make a POST request to the following endpoint with the below parameters:

https://webflow.com/oauth/revoke_authorization

Request Parameters

client_id
stringRequired

The unique identifier for your OAuth application.

client_secret
stringRequired

The secret key associated with your OAuth application.

access_token
stringRequired

The access token that you wish to revoke.

Example Request

cURL
1curl -X POST https://webflow.com/oauth/revoke_authorization \
2 -H "Content-Type: application/json" \
3 -d '{
4 "client_id": "2ccc1b455c782fd60093590c83ee5e315b36bd6640507bb48570e5d0265c2854",
5 "client_secret": "d26ec60528020e1caf426db1a20dceaf5f4e3581bb29bc659b2886d46a7160ed",
6 "access_token": "53db404efe82daea0c65c635a49bc9388e470146b4d800f559cb9a7f3daf83f1"
7 }'

Response

If the request is successful, the access token will be revoked, and the response will return an HTTP status code of 200 OK with the following response body:

1{
2 "did_revoke": true
3}

Possible Errors

Error TypeDescription
invalid_clientThe client_id or client_secret is invalid or does not match the provided credentials.
invalid_tokenThe access_token provided does not exist or has already been revoked.
invalid_requestThe request is missing one or more required parameters, or is otherwise malformed.


Troubleshooting


Was this page helpful?
Built with