OAuth
This tutorial guides you through setting up an OAuth 2.0 authentication flow. This flow allows users to grant limited permissions to your App and enables your App to request an access token to perform actions on behalf of the user.
By the end of this tutorial, your Webflow App will be able to obtain an access token on behalf of a user using the Authorization Code Grant flow.
Authorization Code Grant Flow
Webflow uses the Authorization Code Grant flow to provide access tokens to Apps. This flow involves a series of interactions between Webflow’s authorization server and your web app. Here’s how the process works when a user visits your site for the first time:
- User sign-up/Login: A user signs up or logs in to your App. At some point, they may need to perform an action that requires using the Webflow API.
- Authorization request: To make requests to the Webflow API on the user’s behalf, your App redirects the user to an authorization screen. Here, they can review the permissions your App is requesting and authorize access to specific Webflow Sites or a Workspace.
- User authorization: Once the user grants authorization, Webflow redirects them back to your App via a redirect URI specified during the app setup, adding a
code
parameter to the query string. - Token Request: Your app uses the
code
to make a secure request to Webflow’s authorization server to obtain an access token. If the request is valid, Webflow responds with an access token. - API Requests: Your app can now use this access token to make requests to the Webflow API on behalf of the user.
Get an access token
Requirements
Before you begin, ensure you have the following:
- A Webflow App created with the “Data Client” building block. Learn more here
- Your app’s client credentials:
client_id
andclient_secret.
Note: Only workspace administrators are authorized to view a client secret. If you’re not a site administrator, please contact one to get the secret for you.
Revoke an access token
To revoke an access token that has been issued to your application, make a POST request to the following endpoint with the below parameters:
Request Parameters
The unique identifier for your OAuth application.
The secret key associated with your OAuth application.
The access token that you wish to revoke.
Example Request
Response
If the request is successful, the access token will be revoked, and the response will return an HTTP status code of 200
OK with the following response body: