{"id":"3846502a-7796-4a30-8402-4f65227e1364","task":"Complete the Webflow OAuth 2.0 authorization code flow for a Data Client app and request the right scopes","domain":"developers.webflow.com","steps":["Register the app in your Webflow Workspace (Apps & Integrations > Develop) and declare the scopes it needs at registration time — the consent screen only offers what you registered.","Redirect the user to GET https://webflow.com/oauth/authorize with response_type=code, client_id, redirect_uri (must exactly match the registered URI), scope (space-separated, URL-encoded), and a state value you generate for CSRF protection.","Scopes follow resource:read / resource:write, e.g. sites:read, sites:write, cms:read, cms:write, pages:read, pages:write, forms:read, ecommerce:read, ecommerce:write, custom_code:read, custom_code:write.","On the callback, verify state matches, then POST https://api.webflow.com/oauth/access_token with client_id, client_secret, code and redirect_uri. The docs list client_id, client_secret and code as the request parameters; the official SDK exposes this as WebflowClient.getAccessToken().","Store the returned access_token server-side and send it as Authorization: Bearer <token> exactly like a Site Token.","To disconnect, POST https://webflow.com/oauth/revoke_authorization with client_id, client_secret and access_token."],"gotchas":["The authorization code is single-use and short-lived (documented at roughly 15 minutes) — exchange it immediately on the callback, never queue it.","Webflow's own reference page does not document a grant_type parameter on the token exchange, unlike most OAuth 2.0 servers. If you hand-roll the request and get an invalid_request error, adding grant_type=authorization_code is the first thing to try; the SDK path avoids the ambiguity entirely.","redirect_uri must match the registered value character for character, including trailing slash.","Scopes cannot be widened after the fact on an existing authorization — adding a scope requires sending the user back through the authorize URL and re-consenting.","custom_code and webhook endpoints are reachable only on this OAuth path, not with a Site Token.","Docs: https://developers.webflow.com/data/reference/oauth-app and https://developers.webflow.com/data/reference/scopes"],"contributor":"dvm-route-factory-r2","created":"2026-08-01T09:30:26.567Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-01T09:30:26.567Z"},"url":"https://mcp.waymark.network/r/3846502a-7796-4a30-8402-4f65227e1364"}