Webflow Connector

Illustration · sample data

Sync example

Review one record

Source

Webflow

Connector status: In progress

→

Destination

Your other tool

Connector status: Custom tool

Field mapping

Source field	Destination field	Sample value
record.id	source_id	record_1042
record.updated_at	updated_at	2026-10-18T08:00:00Z
record.value	value	sample_value

1. Draft
2. Review one record
3. Approve this version

Statuses describe individual connectors; they do not guarantee this sync is ready. Illustrative fields. Review the actual schema and permissions before a sync runs.

Implementation Overview

Property	Value
Integration surface	API + MCP
Status	In progress
Category	Website Builder
Setup complexity	easy
Vendor documentation	developers.webflow.com/data/docs/getting-started-apps
Allowed host	api.webflow.com
Base URL	https://api.webflow.com/v2
OpenAPI schema	integrations/webflow/spec/openapi.yml
MCP server	mcp.webflow.com/sse
Last researched	2026-08-07

The MCP endpoint was verified by handshake on 2026-08-07: 401 with RFC 9728 metadata; it is its own authorization server and supports dynamic client registration.

Authentication

• Bearer token (OpenAPI mode). Sent as Authorization: Bearer <token>. Tajo resolves it per workspace (WEBFLOW_ACCESS_TOKEN).

• OAuth 2.0 (MCP mode).

  • Authorize: mcp.webflow.com/oauth/authorize
  • Token: mcp.webflow.com/oauth/token
  • The authorization server publishes no scope list.

• Restrict outbound API traffic to api.webflow.com unless the vendor documents additional regional hosts.

• Use https://api.webflow.com/v2 as the default REST base URL and keep regional or account-specific overrides configurable.

• Use integrations/webflow/spec/openapi.yml to generate or validate typed API clients and request models.

• Validate the MCP server endpoint at mcp.webflow.com/sse and document required headers, auth grants, and tool availability.

• Keep developers.webflow.com/data/docs/getting-started-apps linked from the connector runbook so operators can confirm vendor behavior during incidents.

• Store credentials per Tajo workspace and keep tenant-specific secrets out of connector configuration files.

• Add a credential smoke test that verifies read access to a harmless resource before running backfills or enabling webhooks.

Data To Sync

Start with these inferred data domains, then confirm exact vendor resources and permissions from the source documentation:

• Commerce, payment, or subscription objects
• Events, webhooks, and behavioral activity

The connector should make source records idempotent by keeping a stable key such as a vendor object ID, email address, event ID, ticket ID, order ID, or campaign ID. If the vendor only exposes list APIs, Tajo should store the cursor strategy and replay policy explicitly.

Sync Shape

Resource	Direction	Conflict handling
form_submissions	inbound	n/a
orders	inbound	n/a

Mapping To Tajo/Brevo

Webflow has a typed contract, and every resource on it is read for context rather than projected into Brevo. That is a recorded decision, not a gap: no field of this connector currently becomes a Brevo contact, list, or event.

The conventions that apply to every connector — stable external IDs, normalization, backfill and sync strategy, error handling, and the builder checklist — are documented once under “Applies to every connector” on the connector catalog.

Sources

• Vendor documentation
• MCP endpoint or documentation
• github.com/webflow/openapi-spec
• developers.webflow.com/data/reference
• github.com/webflow/mcp-server
• mcp.webflow.com/.well-known/oauth-protected-resource/sse