Webflow setup guide

Agents read and update your website's content.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Webflow, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

Webflow can be connected 2 ways. Where there’s a key or token to paste, that’s usually the quickest.

Site API token

API key.

1. As a site administrator, open the site in Webflow and go to Site settings > Apps & integrations > API access.
2. Click Generate API token, name it "Everdeck" and give it these scopes: Sites (read and write), CMS (read and write), Pages (read and write) and Forms (read).
3. Copy the token right away; it is shown only once. Each site can have up to 5 tokens, and a token expires after 365 days without use.

Field	What to enter
Site API token	A secret: Everdeck saves it encrypted and never shows it again. Where to find it.
Site ID (optional)	Text. Filled in for you: a site token reaches one site. Find it in Site settings > General > Overview.

Disconnecting deletes the credentials Everdeck saved, but Everdeck can't revoke them: the key, token or password itself keeps working at Webflow until you delete or rotate it there.

Your Webflow app (several sites)

Your OAuth app.

This way signs in with an OAuth app you create for Webflow, as its steps describe: Everdeck never uses an app of its own. Register this redirect URI with your app:

https://everdeck.io/api/oauth/callback

Then save the app’s client ID and secret in Everdeck, on the connect page or under OAuth apps, and sign in.

1. As a Workspace admin, open Settings > Apps & Integrations in Webflow and, under App Development, click Create an App. Choose the Data Client building block.
2. Set the redirect URI to https://everdeck.io/api/oauth/callback and enable the scopes listed below; the authorize link may not ask for scopes the app does not have.
3. Copy the Client ID and Client Secret into the form.
4. Click Connect and authorize the app for the site the agent should work on.

Field	What to enter
Site ID (optional)	Text. Only if the sign-in can reach several sites: the one the agent should work on (Site settings > General > Overview).

The scopes Everdeck asks for:

• sites:read
• sites:write
• cms:read
• cms:write
• pages:read
• pages:write
• forms:read

When you disconnect, Everdeck asks Webflow to revoke the sign-in, then deletes the tokens it saved.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• List CMS collectionsTier 0 · ReadReads outside contentwebflow_list_collections

  List the site's CMS collections (for example Blog Posts, Team, Locations) with their ids.

• Get a collection's fieldsTier 0 · ReadReads outside contentwebflow_get_collection

  Read a collection's fields: slug, display name, type (PlainText, RichText, Image, Option, Reference, ...), whether it is required, and validations such as option ids. Read this before writing items.

• Find CMS itemsTier 0 · ReadReads outside contentwebflow_list_items

  List a collection's items (staged versions, drafts included), most recently changed first. Filter by words in the name, an exact slug, or a change date.

• Read a CMS itemTier 0 · ReadReads outside contentwebflow_get_item

  Read one item with all its field values (the staged version, which may differ from the live site).

• Draft a CMS itemTier 2 · ReversibleReads outside contentwebflow_create_item

  Create an item (for example a blog post) as a draft. It stays off the live site, even when someone publishes the site, until publish_items is used.

• Edit a CMS itemTier 2 · ReversibleReads outside contentwebflow_update_item

  Change some fields of an item. The edit is saved as a draft: the live site keeps the old version until publish_items is used. Fields not sent keep their values.

• Publish CMS itemsTier 3 · ExternalReads outside contentwebflow_publish_items

  Publish items to the live site now (drafts included), without publishing the rest of the site. Use it after a person has approved the content.

• List pagesTier 0 · ReadReads outside contentwebflow_list_pages

  List the site's pages with their SEO title and description, path and draft state.

• Read a page's textTier 0 · ReadReads outside contentwebflow_get_page_content

  Read the text and image alt text on a static page, node by node, to review or proofread copy.

• Update page title and SEOTier 2 · ReversibleReads outside contentwebflow_update_page_settings

  Change a page's name, slug, SEO title or meta description. Changes reach the live site at the next site publish. The slug of the home page, template and utility pages cannot be changed.

• Publish the siteTier 3 · ExternalReads outside contentwebflow_publish_site

  Publish the whole site, or one page, to all its custom domains and the webflow.io address. Every staged change goes live, including other people's work and CMS items not marked as draft.

• List form submissionsTier 0 · ReadReads outside contentwebflow_list_form_submissions

  Read submissions from the site's forms (contact, quote and signup forms): form name, date and the submitted fields. Submissions are written by visitors.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If Webflow later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit or Reconnect.

To stop agents using Webflow, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.