webflow-security-basics

# Webflow Security Basics ## Overview Security best practices for Webflow Data API v2 tokens, OAuth secrets, webhook verification, and access control. Covers the full lifecycle from token creation to rotation and revocation. ## Prerequisites - Webflow developer account at `developers.webflow.com` - Understanding of environment variables - Secret management solution (vault, cloud secret manager, etc.) ## Instructions ### Step 1: Token Types and Selection | Token Type | Scope | Best For | |------------|-------|----------| | **Workspace Token** | All sites in workspace | Internal tools, scripts | | **Site Token** | Single site only | Single-site integrations | | **OAuth Access Token** | User-authorized scopes | Public apps, marketplace apps | **Rule: Never use a workspace token where a site token would suffice.** ### Step 2: Least Privilege Scopes Only request scopes your integration actually needs: | Operation | Minimum Scope | |-----------|--------------| | Read site info | `sites:read` | | Publish site | `sites:write` | | Read CMS content | `cms:read` | | Create/update CMS items | `cms:write` | | Read pages | `pages:read` | | Read form submissions | `forms:read` | | Read products/orders | `ecommerce:read` | | Create products, fulfill orders | `ecommerce:write` | ```typescript // Example: Read-only integration needs only these scopes const READ_ONLY_SCOPES = "sites:read cms:read pages:read forms:read"; // CMS sync integration const CMS_SYNC_SCOPES = "sites:read cm...