v2.14.0: Session-based auth without .env tokens, and single-React library builds
v2.14.0 stops writing access tokens to .env, makes code library builds fail when more than one React copy would ship, and tightens deploy interrupt recovery, --json output, and resource id validation.
Session-based auth — no token in .env
webflow auth login and webflow apps init no longer write your access token to .env. The CLI uses your login session instead (apps init still writes WEBFLOW_SITE_ID).
A token loaded from ./.env is never sent to the other region’s API: a session for the region you’re targeting takes precedence, and a command whose session belongs to the other region stops with exit code 3 before sending anything. Export WEBFLOW_API_TOKEN in your shell to override deliberately.
webflow auth logout warns if ./.env still holds a token, and now supports --json. webflow auth status labels a token that came from ./.env and reports a cross-region refusal as not ready.
Single React copy in code library builds
Code library builds now resolve react and react-dom from your library’s root folder (the one with webflow.json). A dependency or workspace package that installs its own React no longer adds a second copy to the bundle.
If the build still finds more than one copy, or the react and react-dom versions don’t match, it fails and lists where each copy comes from. Before this, those builds succeeded but the components crashed in the Designer.
Add --dry-run to webflow devlink import or webflow library share to run every build check without creating or uploading the library.
Other fixes
apps init --site-idnow saves the site inwebflow.json, so site-attachedapps deploycan validate the mount (and auto-publish with--auto-publish) before the first deploy wrote the site.- Ctrl-C during
apps deployrestores your framework config and marks the deployment failed (exit 130). A later deploy recovers the original config instead of overwriting a leftover backup. --jsonoutput is exactly the JSON document — no leading blank line or one-space indent.cms --dry-run --jsonprints only the plan document.- Out-of-support Next.js majors (for example Next.js 15) build again on Webflow Cloud instead of failing OpenNext’s support-policy check.
appscommands andcloud deployreject malformed resource ids before calling the API (app/environment/deployment ids must be UUIDs; site/workspace ids must be 24-character hex), exiting 2 instead of a 404 or empty result.