> This page is for Webflow Cloud.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developers.webflow.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.webflow.com/_mcp/server.

# GitHub App permissions

> Why Webflow Cloud requests GitHub App and OAuth permissions, and how each permission is used

Webflow Cloud connects to GitHub through the [Webflow Cloud GitHub App](https://github.com/apps/webflow-cloud/installations/select_target) and a short OAuth authorize step. Enterprise security reviews often ask why the App requests **Administration: write**, **Contents: write**, and **user:email**. This page documents each permission: what Webflow Cloud uses it for, which credential exercises it, and what Webflow Cloud does **not** do with it.

Install or update the App for an account or organization here: [Install Webflow Cloud](https://github.com/apps/webflow-cloud/installations/select_target).

## Two kinds of credentials

Webflow Cloud uses two GitHub credentials. Security reviews should treat them separately.

| Credential                  | When you grant it                                                                                          | What it can do                                                                                          |
| :-------------------------- | :--------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------ |
| **GitHub App installation** | You install the Webflow Cloud GitHub App on a personal account or organization and grant repository access | Acts as the Webflow Cloud bot on repos the installation covers (for example, the initial template push) |
| **User OAuth token**        | You click **Login to GitHub** / authorize Webflow Cloud                                                    | Acts as **you** for login identity and for creating a new repository under your account or org          |

Ongoing deployments read the connected repository through the App installation. Creating a brand-new repo from a starter template uses your user OAuth token for repository creation, then the App installation token for the first commit so GitHub attributes that commit to the Webflow Cloud bot.

## Permission summary

| Permission     | Level | Type             | When Webflow Cloud uses it                                                                   | Credential that exercises it                |
| :------------- | :---- | :--------------- | :------------------------------------------------------------------------------------------- | :------------------------------------------ |
| Contents       | read  | Repository (App) | Reading repository contents for builds and deployments                                       | App installation token                      |
| Contents       | write | Repository (App) | One-time initial commit when cloning a starter template into a new repo                      | App installation token                      |
| Metadata       | read  | Repository (App) | Looking up repositories, branches, and installation coverage                                 | App installation / App JWT                  |
| Administration | write | Repository (App) | Required by Webflow Cloud’s installation permission check before the deploy wizard continues | Checked on the App installation (see below) |
| `user:email`   | read  | Account (OAuth)  | Login and GitHub account linking — `GET /user/emails`                                        | User OAuth token                            |

GitHub’s App UI shows a single **Contents** permission. Webflow Cloud requests **Contents: write**, which includes read. The table splits read vs write by purpose so the write grant is not attributed to read-only work.

## Repository permissions

### Contents

**Purpose:** Read connected repositories for builds, and push the first commit when creating an app from a starter template.

GitHub grants Contents as one permission. Webflow Cloud requests **Contents: write** (which includes **Contents: read**).

**Contents: read is used for:**

* Shallow clone / read of the connected repo so Webflow Cloud can build and deploy on each qualifying push

**Contents: write is used for:**

* One-time `git push` of the starter template into a newly created repository, using the App installation token so the commit is attributed to the Webflow Cloud bot

**Not used for:**

* Editing your code after the initial template push
* Force-pushing, rewriting history, or managing pull requests
* Accessing repositories outside the ones you granted to the App installation

### Metadata: read

**Purpose:** Allow Webflow Cloud to discover whether the App is installed for a repository and to read basic repository metadata (name, default branch, visibility).

**Used for:**

* Checking App installation status for a repo
* Listing or resolving repositories and branches during connect and deploy flows

**Not used for:**

* Reading file contents (that is **Contents**)
* Changing repository settings

### Administration: write

**Purpose:** Webflow Cloud’s own installation permission check requires `administration: write` (along with `contents: write` and `metadata: read`) before the deploy wizard continues. If the installation is missing that permission, the product surfaces a GitHub App permissions update prompt.

That check is the operative reason the App requests Administration: write today. Repository creation in the starter-template flow does **not** run as the App installation token — it runs as your **user OAuth token** via `POST /user/repos` (personal account) or `POST /orgs/{org}/repos` (organization). GitHub’s personal-account create endpoint does not accept installation tokens; Webflow Cloud uses the user token for both personal and organization paths for consistency. The App installation token is then used only for the one-time **Contents: write** template push.

Webflow Cloud does **not** use Administration to:

* Delete repositories
* Change repository settings, collaborators, webhooks, or Actions configuration
* Transfer repositories or modify organization settings

## Account permission: `user:email`

**Purpose:** Identify the GitHub user during **Login to GitHub** / account linking.

**Used for:**

* `GET /user/emails` during the OAuth login and connect callbacks
* Verifying a primary email when linking a GitHub identity to a Webflow account

**Not used for:**

* Sending email on your behalf
* Repository access (that is the App installation)
* Reading private repository contents

This is an **OAuth account** permission, not a repository permission on the GitHub App. It appears during authorize / login, not as a repository checkbox on the App installation.

## How this maps to common flows

### Create an app from a starter template

1. You authorize GitHub (`user:email`) and install the Webflow Cloud GitHub App (Contents, Metadata, Administration on the installation).
2. Webflow Cloud creates a new repository under your user or org with your **user OAuth token**.
3. Webflow Cloud pushes the starter files with the **App installation token** (**Contents: write**).
4. Webflow Cloud creates the Cloud app and environment and starts the first deployment.

### Bring your own repository / ongoing deploys

1. You install the App on the account or org that owns the repository and grant it access to that repo.
2. Webflow Cloud reads the monitored branch through the App installation (**Contents: read** / **Metadata**) and builds on each qualifying push.
3. Webflow Cloud does **not** push commits to your existing repository as part of normal deploys.

## FAQ for security reviews

#### Why does the App request Administration: write if create-repo uses my user token?

Because Webflow Cloud’s installation permission check requires `administration: write` before the deploy wizard proceeds — not because GitHub requires Administration on the App for a user-token create-repo call. Create-repo HTTP calls use your user OAuth token for both personal and organization targets. The App installation token is used for the one-time Contents write (template push).

#### Does Webflow Cloud keep write access to edit my code after setup?

After the one-time template push (starter-template flow only), ongoing deploys only need to read the connected repository. Webflow Cloud does not use the App to edit your application source as part of normal deployments.

#### Does user:email give Webflow access to my repositories?

No. `user:email` is only used to read email addresses during login and account linking. Repository access comes from the GitHub App installation you grant to specific accounts, organizations, and repositories.

#### Where do I review or revoke access?

Review or uninstall the App from GitHub: [Webflow Cloud installations](https://github.com/apps/webflow-cloud/installations/select_target). You can also disconnect GitHub from Webflow Cloud in the deploy wizard or app settings and re-authorize with a narrower repository set if your org policy requires it.

## Related

* [Getting started](/webflow-cloud/getting-started) — create an app from a starter template
* [Bring your own app](/webflow-cloud/bring-your-own-app) — connect an existing repository
* [Deployments](/webflow-cloud/deployments) — how pushes become builds