This tutorial guides you through setting up an OAuth 2.0 authentication flow. This flow allows users to grant limited permissions to your App and enables your App to request an access token to perform actions on behalf of the user.

By the end of this tutorial, your Webflow App will be able to obtain an access token on behalf of a user using the Authorization Code Grant flow.

Quickstart

Our example Apps come with the OAuth 2.0 flow already set up for you. Start building your Webflow App quickly by using one of our pre-configured example apps.

CMS Explorer

Authorization Code Grant Flow

Webflow uses the Authorization Code Grant flow to provide access tokens to Apps. This flow involves a series of interactions between Webflow’s authorization server and your web app. Here’s how the process works when a user visits your site for the first time:

1. User sign-up/Login: A user signs up or logs in to your App. At some point, they may need to perform an action that requires using the Webflow API.
2. Authorization request: To make requests to the Webflow API on the user’s behalf, your App redirects the user to an authorization screen. Here, they can review the permissions your App is requesting and authorize access to specific Webflow Sites or a Workspace.
3. User authorization: Once the user grants authorization, Webflow redirects them back to your App via a redirect URI specified during the app setup, adding a code parameter to the query string.
4. Token Request: Your app uses the code to make a secure request to Webflow’s authorization server to obtain an access token. If the request is valid, Webflow responds with an access token.
5. API Requests: Your app can now use this access token to make requests to the Webflow API on behalf of the user.

Get an access token

Requirements

Before you begin, ensure you have the following:

• A Webflow App created with the “Data Client” building block. Learn more here
• Your app’s client credentials: client_id and client_secret.
  
  Note: Only workspace administrators are authorized to view a client secret. If you’re not a site administrator, please contact one to get the secret for you.

Revoke an access token

To revoke an access token that has been issued to your application, make a POST request to the following endpoint with the below parameters:

https://webflow.com/oauth/revoke_authorization

Request Parameters

Example Request

1
curl -X POST https://webflow.com/oauth/revoke_authorization \
2
  -H "Content-Type: application/json" \
3
  -d '{
4
        "client_id": "2ccc1b455c782fd60093590c83ee5e315b36bd6640507bb48570e5d0265c2854",
5
        "client_secret": "d26ec60528020e1caf426db1a20dceaf5f4e3581bb29bc659b2886d46a7160ed",
6
        "access_token": "53db404efe82daea0c65c635a49bc9388e470146b4d800f559cb9a7f3daf83f1"
7
      }'

Response

If the request is successful, the access token will be revoked, and the response will return an HTTP status code of 200 OK with the following response body:

1
{
2
    "did_revoke": true
3
}

Possible Errors

Troubleshooting