Webflow Site Tokens

Connect one Webflow site with a site API token. Choose its scopes in the site settings, then add the token to Agent Serve.

Prerequisites

Only site administrators can generate site tokens. Each site allows a maximum of 5 tokens — if you're at the cap, revoke an unused one before creating a token for Agent Serve.

Setting Up the Site Token

Open your site's Site settings and go to Apps & integrations → API access

Click Generate API token and give it a recognizable name (e.g. agentserve-workflows)

Select the scopes the token needs. The minimum set for Agent Serve's Webflow blocks is:

Sites: Read-only
CMS: Read and write

The picker offers no access, read-only, or read and write per category. Sites: Read-only (sites:read) is required for Agent Serve to verify the token when you connect it. CMS: Read and write (cms:read + cms:write) covers Agent Serve's Webflow tools — listing, getting, creating, updating, and deleting CMS items. Add other scopes only if you need them

Copy the token when it's shown. Webflow only displays it once — if you close the dialog, you'll have to generate a new token.

Site tokens expire after 365 consecutive days of inactivity. Any API call resets the clock, so a workflow that runs regularly keeps its token alive indefinitely — but a workflow that sits dormant for a year will start failing silently with authentication errors. If a workflow runs rarely, set a calendar reminder to run it (or any Webflow block) at least once a year, or check the credential periodically in Agent Serve.

Adding the Site Token to Agent Serve

Open Integrations from your workspace sidebar

Search for "Webflow" and open it, then click Add to Agent Serve and choose Add site token

Paste the site API token and optionally set a display name and description

Click Add site token. Agent Serve verifies the token by listing the sites it can access — if it fails, you'll see a specific error explaining what went wrong. A token created without the sites:read scope fails this check even if its CMS scopes are correct.

The token is encrypted before being stored, along with the site it grants access to.

Using the Credential in Workflows

Add a Webflow block to your workflow. In the credential dropdown, select the saved Webflow site token. Select it and configure the block as you normally would.

The block calls Webflow's Data API (api.webflow.com/v2/...) using the token. It can only reach collections and items belonging to the token's site — pointing a block at a different site's collection fails with an access error.

Common Questions

No. A site token is bound to exactly one site. If your workflows touch several Webflow sites, generate a token on each site and add each as a separate credential in Agent Serve. For many sites, Webflow's OAuth flow may be more practical.

The most common cause is a missing Sites: Read scope — Agent Serve verifies the token by listing its accessible sites, so a CMS-only token fails validation even though the CMS tools themselves would work. Generate a new token that includes Sites: Read.

Only from inactivity: 365 consecutive days without any API call. Regular use resets the clock. A dormant credential dies silently, so run rarely-used workflows at least once a year or set a reminder.

Generate a new token from the site's API access settings (watch the 5-token-per-site cap), update the credential in Agent Serve, and once it's working, revoke the old one.

Scopes are fixed at creation — generate a new token with the wider scope set, update the credential in Agent Serve, and revoke the old token. Scope failures show up as 401 authorization errors on the failing block.