Webflow OAuth

This page covers the technical details of SitePulse's Webflow OAuth integration. For CMS patching setup and field mappings, see Webflow Integration.

Authorization flow

SitePulse uses OAuth 2.1 with PKCE (Proof Key for Code Exchange) — the same flow required by Webflow's API for third-party integrations.

Flow steps

1. User clicks Connect Webflow in Project Settings → Integrations
2. SitePulse generates a code_verifier (random 64-byte value) and code_challenge (SHA-256(code_verifier))
3. User is redirected to Webflow's authorization URL:

   https://webflow.com/oauth/authorize?
     response_type=code
     &client_id=<sitepulse_client_id>
     &redirect_uri=<callback_url>
     &scope=cms:read cms:write sites:read
     &code_challenge=<code_challenge>
     &code_challenge_method=S256
   

4. User reviews scopes and clicks Authorize
5. Webflow redirects to SitePulse's callback with an authorization code
6. SitePulse exchanges the code for an access token:

   POST https://api.webflow.com/oauth/access_token
   {
     "grant_type": "authorization_code",
     "code": "<auth_code>",
     "code_verifier": "<code_verifier>",
     "client_id": "<client_id>",
     "client_secret": "<client_secret>"
   }
   

7. Access token is stored encrypted in the project's integrations JSONB field

Token storage

Webflow access tokens are stored in project.integrations['webflow']['access_token'] as AES-256-GCM encrypted values. The encryption key is derived from the application secret.

Tokens are decrypted in memory only during CMS patch API calls.

Token expiry

Webflow access tokens do not expire (they are long-lived tokens, not short-lived JWTs). They become invalid only if:

• The user revokes SitePulse's access in Webflow's Authorized Apps settings
• The Webflow site is deleted
• Webflow revokes the token (rare — typically for ToS violations)

When a token becomes invalid, CMS patch calls return a 401 and SitePulse shows a "Reconnect Webflow" prompt.

PKCE security benefits

PKCE prevents authorization code interception attacks. Even if an attacker intercepts the authorization code in transit, they cannot exchange it for a token without the code_verifier — which is generated on the client and never transmitted to the server until the exchange step.

This makes the Webflow OAuth flow safe even without a client secret on public/mobile clients (though SitePulse uses a confidential client with a server-side secret for additional security).

Disconnect behavior

When you disconnect Webflow (Project Settings → Integrations → Disconnect), SitePulse:

1. Deletes the encrypted access token from project.integrations
2. Does not call Webflow's token revocation endpoint (Webflow's API does not currently expose one)

To fully revoke access: remove SitePulse from Webflow Account Settings → Authorized Apps.