Webflow Site Tokens

Webflow site tokens let your workflows authenticate to a single Webflow site with a token you generate from the site's settings — no OAuth consent, no user account attached. You pick the scopes at creation, and the token is bound to exactly that site.

This is the recommended way to use Webflow in production workflows: the credential belongs to the site rather than to a person, its scopes are explicit, and it can be revoked from site settings without touching anyone's account.

Prerequisites

Only site administrators can generate site tokens. Each site allows a maximum of 5 tokens — if you're at the cap, revoke an unused one before creating a token for Sim.

Setting Up the Site Token

Open your site's Site settings and go to Apps & integrations → API access

Click Generate API token and give it a recognizable name (e.g. sim-workflows)

Select the scopes the token needs. The minimum set for Sim's Webflow blocks is:

Sites: Read-only
CMS: Read and write

The picker offers no access, read-only, or read and write per category. Sites: Read-only (sites:read) is required for Sim to verify the token when you connect it. CMS: Read and write (cms:read + cms:write) covers Sim's Webflow tools — listing, getting, creating, updating, and deleting CMS items. Add other scopes only if you need them

Copy the token when it's shown. Webflow only displays it once — if you close the dialog, you'll have to generate a new token.

Site tokens expire after 365 consecutive days of inactivity. Any API call resets the clock, so a workflow that runs regularly keeps its token alive indefinitely — but a workflow that sits dormant for a year will start failing silently with authentication errors. If a workflow runs rarely, set a calendar reminder to run it (or any Webflow block) at least once a year, or check the credential periodically in Sim.

Adding the Service Account to Sim

Open your workspace Settings and go to the Integrations tab

Search for "Webflow Service Account" and click it, then click Add to Sim and choose Add site token

Paste the site API token and optionally set a display name and description

Click Add site token. Sim verifies the token by listing the sites it can access — if it fails, you'll see a specific error explaining what went wrong. A token created without the sites:read scope fails this check even if its CMS scopes are correct.

The token is encrypted before being stored, along with the site it grants access to.

Using the Service Account in Workflows

Add a Webflow block to your workflow. In the credential dropdown, your Webflow service account appears alongside any OAuth credentials. Select it and configure the block as you normally would.

The block calls Webflow's Data API (api.webflow.com/v2/...) using the token. It can only reach collections and items belonging to the token's site — pointing a block at a different site's collection fails with an access error.

Common Questions

Site tokens aren't tied to any user account and don't depend on OAuth consent staying valid. They're generated by a site admin, scoped explicitly, and stay valid as long as they're used — which suits automated workflows.

No. A site token is bound to exactly one site. If your workflows touch several Webflow sites, generate a token on each site and add each as a separate credential in Sim. For many sites, Webflow's OAuth flow may be more practical.

The most common cause is a missing Sites: Read scope — Sim verifies the token by listing its accessible sites, so a CMS-only token fails validation even though the CMS tools themselves would work. Generate a new token that includes Sites: Read.

Only from inactivity: 365 consecutive days without any API call. Regular use resets the clock. A dormant credential dies silently, so run rarely-used workflows at least once a year or set a reminder.

Generate a new token from the site's API access settings (watch the 5-token-per-site cap), update the credential in Sim, and once it's working, revoke the old one.

Scopes are fixed at creation — generate a new token with the wider scope set, update the credential in Sim, and revoke the old token. Scope failures show up as 401 authorization errors on the failing block.