> This page is for Home.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developers.webflow.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.webflow.com/_mcp/server.

# v2.14.0: Session-based auth without .env tokens, and single-React library builds

> auth login and apps init no longer write access tokens to .env. Code library builds enforce a single React copy and fail when duplicates or mismatched versions would crash in the Designer.

v2.14.0 stops writing access tokens to `.env`, makes code library builds fail when more than one React copy would ship, and tightens deploy interrupt recovery, `--json` output, and resource id validation.

### Session-based auth — no token in `.env`

`webflow auth login` and `webflow apps init` no longer write your access token to `.env`. The CLI uses your login session instead (`apps init` still writes `WEBFLOW_SITE_ID`).

A token loaded from `./.env` is never sent to the other region's API: a session for the region you're targeting takes precedence, and a command whose session belongs to the other region stops with exit code 3 before sending anything. Export `WEBFLOW_API_TOKEN` in your shell to override deliberately.

`webflow auth logout` warns if `./.env` still holds a token, and now supports `--json`. `webflow auth status` labels a token that came from `./.env` and reports a cross-region refusal as not ready.

### Single React copy in code library builds

Code library builds now resolve `react` and `react-dom` from your library's root folder (the one with `webflow.json`). A dependency or workspace package that installs its own React no longer adds a second copy to the bundle.

If the build still finds more than one copy, or the `react` and `react-dom` versions don't match, it fails and lists where each copy comes from. Before this, those builds succeeded but the components crashed in the Designer.

Add `--dry-run` to `webflow devlink import` or `webflow library share` to run every build check without creating or uploading the library.

### Other fixes

* `apps init --site-id` now saves the site in `webflow.json`, so site-attached `apps deploy` can validate the mount (and auto-publish with `--auto-publish`) before the first deploy wrote the site.
* Ctrl-C during `apps deploy` restores your framework config and marks the deployment failed (exit 130). A later deploy recovers the original config instead of overwriting a leftover backup.
* `--json` output is exactly the JSON document — no leading blank line or one-space indent. `cms --dry-run --json` prints only the plan document.
* Out-of-support Next.js majors (for example Next.js 15) build again on Webflow Cloud instead of failing OpenNext's support-policy check.
* `apps` commands and `cloud deploy` reject malformed resource ids before calling the API (app/environment/deployment ids must be UUIDs; site/workspace ids must be 24-character hex), exiting 2 instead of a 404 or empty result.

## Upgrading

```bash
npm install -g @webflow/webflow-cli@latest
```