Working with Webflow Cloud

GitHub App permissions

What Webflow Cloud requests from GitHub, and what each permission is used for

Webflow Cloud connects to GitHub through the Webflow Cloud GitHub App and a short OAuth authorize step. Enterprise security reviews often ask why the App requests Administration: write, Contents: write, and user:email. This page documents each permission: what Webflow Cloud uses it for, which credential exercises it, and what Webflow Cloud does not do with it.

Install or update the App for an account or organization here: Install Webflow Cloud.

Two kinds of credentials

Webflow Cloud uses two GitHub credentials. Security reviews should treat them separately.

CredentialWhen you grant itWhat it can do
GitHub App installationYou install the Webflow Cloud GitHub App on a personal account or organization and grant repository accessActs as the Webflow Cloud bot on repos the installation covers (for example, the initial template push)
User OAuth tokenYou click Login to GitHub / authorize Webflow CloudActs as you for login identity and for creating a new repository under your account or org

Ongoing deployments read the connected repository through the App installation. Creating a brand-new repo from a starter template uses your user OAuth token for repository creation, then the App installation token for the first commit so GitHub attributes that commit to the Webflow Cloud bot.

Permission summary

PermissionLevelTypeWhen Webflow Cloud uses itCredential that exercises it
ContentsreadRepository (App)Reading repository contents for builds and deploymentsApp installation token
ContentswriteRepository (App)One-time initial commit when cloning a starter template into a new repoApp installation token
MetadatareadRepository (App)Looking up repositories, branches, and installation coverageApp installation / App JWT
AdministrationwriteRepository (App)Required by Webflow Cloud’s installation permission check before the deploy wizard continuesChecked on the App installation (see below)
user:emailreadAccount (OAuth)Login and GitHub account linking — GET /user/emailsUser OAuth token

GitHub’s App UI shows a single Contents permission. Webflow Cloud requests Contents: write, which includes read. The table splits read vs write by purpose so the write grant is not attributed to read-only work.

Repository permissions

Contents

Purpose: Read connected repositories for builds, and push the first commit when creating an app from a starter template.

GitHub grants Contents as one permission. Webflow Cloud requests Contents: write (which includes Contents: read).

Contents: read is used for:

  • Shallow clone / read of the connected repo so Webflow Cloud can build and deploy on each qualifying push

Contents: write is used for:

  • One-time git push of the starter template into a newly created repository, using the App installation token so the commit is attributed to the Webflow Cloud bot

Not used for:

  • Editing your code after the initial template push
  • Force-pushing, rewriting history, or managing pull requests
  • Accessing repositories outside the ones you granted to the App installation

Metadata: read

Purpose: Allow Webflow Cloud to discover whether the App is installed for a repository and to read basic repository metadata (name, default branch, visibility).

Used for:

  • Checking App installation status for a repo
  • Listing or resolving repositories and branches during connect and deploy flows

Not used for:

  • Reading file contents (that is Contents)
  • Changing repository settings

Administration: write

Purpose: Webflow Cloud’s own installation permission check requires administration: write (along with contents: write and metadata: read) before the deploy wizard continues. If the installation is missing that permission, the product surfaces a GitHub App permissions update prompt.

That check is the operative reason the App requests Administration: write today. Repository creation in the starter-template flow does not run as the App installation token — it runs as your user OAuth token via POST /user/repos (personal account) or POST /orgs/{org}/repos (organization). GitHub’s personal-account create endpoint does not accept installation tokens; Webflow Cloud uses the user token for both personal and organization paths for consistency. The App installation token is then used only for the one-time Contents: write template push.

Webflow Cloud does not use Administration to:

  • Delete repositories
  • Change repository settings, collaborators, webhooks, or Actions configuration
  • Transfer repositories or modify organization settings

Account permission: user:email

Purpose: Identify the GitHub user during Login to GitHub / account linking.

Used for:

  • GET /user/emails during the OAuth login and connect callbacks
  • Verifying a primary email when linking a GitHub identity to a Webflow account

Not used for:

  • Sending email on your behalf
  • Repository access (that is the App installation)
  • Reading private repository contents

This is an OAuth account permission, not a repository permission on the GitHub App. It appears during authorize / login, not as a repository checkbox on the App installation.

How this maps to common flows

Create an app from a starter template

  1. You authorize GitHub (user:email) and install the Webflow Cloud GitHub App (Contents, Metadata, Administration on the installation).
  2. Webflow Cloud creates a new repository under your user or org with your user OAuth token.
  3. Webflow Cloud pushes the starter files with the App installation token (Contents: write).
  4. Webflow Cloud creates the Cloud app and environment and starts the first deployment.

Bring your own repository / ongoing deploys

  1. You install the App on the account or org that owns the repository and grant it access to that repo.
  2. Webflow Cloud reads the monitored branch through the App installation (Contents: read / Metadata) and builds on each qualifying push.
  3. Webflow Cloud does not push commits to your existing repository as part of normal deploys.

FAQ for security reviews

Because Webflow Cloud’s installation permission check requires administration: write before the deploy wizard proceeds — not because GitHub requires Administration on the App for a user-token create-repo call. Create-repo HTTP calls use your user OAuth token for both personal and organization targets. The App installation token is used for the one-time Contents write (template push).

After the one-time template push (starter-template flow only), ongoing deploys only need to read the connected repository. Webflow Cloud does not use the App to edit your application source as part of normal deployments.

No. user:email is only used to read email addresses during login and account linking. Repository access comes from the GitHub App installation you grant to specific accounts, organizations, and repositories.

Review or uninstall the App from GitHub: Webflow Cloud installations. You can also disconnect GitHub from Webflow Cloud in the deploy wizard or app settings and re-authorize with a narrower repository set if your org policy requires it.