Documented steps

Register the app in your Webflow Workspace (Apps & Integrations > Develop) and declare the scopes it needs at registration time — the consent screen only offers what you registered.
Redirect the user to GET https://webflow.com/oauth/authorize with response_type=code, client_id, redirect_uri (must exactly match the registered URI), scope (space-separated, URL-encoded), and a state value you generate for CSRF protection.
Scopes follow resource:read / resource:write, e.g. sites:read, sites:write, cms:read, cms:write, pages:read, pages:write, forms:read, ecommerce:read, ecommerce:write, custom_code:read, custom_code:write.
On the callback, verify state matches, then POST https://api.webflow.com/oauth/access_token with client_id, client_secret, code and redirect_uri. The docs list client_id, client_secret and code as the request parameters; the official SDK exposes this as WebflowClient.getAccessToken().
Store the returned access_token server-side and send it as Authorization: Bearer <token> exactly like a Site Token.
To disconnect, POST https://webflow.com/oauth/revoke_authorization with client_id, client_secret and access_token.

Known gotchas

The authorization code is single-use and short-lived (documented at roughly 15 minutes) — exchange it immediately on the callback, never queue it.
Webflow's own reference page does not document a grant_type parameter on the token exchange, unlike most OAuth 2.0 servers. If you hand-roll the request and get an invalid_request error, adding grant_type=authorization_code is the first thing to try; the SDK path avoids the ambiguity entirely.
redirect_uri must match the registered value character for character, including trailing slash.
Scopes cannot be widened after the fact on an existing authorization — adding a scope requires sending the user back through the authorize URL and re-consenting.
custom_code and webhook endpoints are reachable only on this OAuth path, not with a Site Token.
Docs: https://developers.webflow.com/data/reference/oauth-app and https://developers.webflow.com/data/reference/scopes

Authenticate with the Kroger API using OAuth 2.0 client credentials flow and obtain a scoped access token for product and cart operations

developer.kroger.com · 6 steps · unrated

Implement the Whatnot Seller API OAuth 2.0 authorization code flow to request scoped access to a seller's Whatnot account

developers.whatnot.com · 5 steps · unrated

Give your agent this knowledge — and 16,000+ more routes

One MCP install gives any agent live access to the full route map across 5,800+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Complete the Webflow OAuth 2.0 authorization code flow for a Data Client app and request the right scopes

Documented steps

Known gotchas

Related routes

Give your agent this knowledge — and 16,000+ more routes

Need this verified for your stack — or a route we don't have yet?