Webflow
Connect Webflow to manage sites and pages, publish CMS collections and items, handle ecommerce orders, and upload assets.
One Webflow site API token, generated under Site settings, Apps & integrations, API access, pasted into PopMCP's API token field.
- Setup time
- 4 min
- Auth
- API credentials
- API base URL
- https://api.webflow.com/v2
- Rate limits
- 60 requests per minute on Starter and Basic site plans, 120 per minute on CMS, Business and Ecommerce plans, applied per API key. Site publish is limited to one successful publish per minute.
Before you begin
- A Webflow account with admin access to the site you are connecting, because only site admins can generate API tokens
- Fewer than 5 existing API tokens on the site, which is the per-site maximum
- An Ecommerce site plan if you want the product and order tools
Get your credentials
Open Site settings for the site you want to connect
Sign in at webflow.com/dashboard and open the workspace that owns the site. Click the gear icon on the site's card to open Site settings.
Sites
Sites in the Acme Supply workspace.
| Site | Plan | Status | Last published |
|---|---|---|---|
| acme-storeacme-store.webflow.io | Ecommerce | Published | Mar 4, 2026 |
| acme-marketingacme-marketing.webflow.io | Basic | Draft | Feb 18, 2026 |
Tokens belong to one site, so open the settings for the site you actually want PopMCP to reach.
Open Apps & integrations and scroll to API access
In the Site settings sidebar click Apps & integrations. Scroll to the API access section at the bottom of the page.
Apps & integrations
Connected apps, integrations and API access for this site.
| Token name | Permissions | Created | Last used | Status |
|---|---|---|---|---|
| Zapier sync****3ac1 | 5 APIs | Jan 9, 2026 | Mar 2, 2026 | Active |
| Old import script****81de | 2 APIs | Jun 3, 2025 | Never | Revoked |
API access sits below the connected apps list, at the very bottom of this page.
Name the token and set a permission for each API
Click Generate API token, type PopMCP as the name, then set a permission level for every Webflow API. Set CMS, Sites, Pages and Assets to Read and write, set Forms to Read-only, set Ecommerce to Read and write if the site sells, and click Generate token.
Generate API token
Choose what this token may read and write on acme-store.
| API | Scopes | Permission |
|---|---|---|
| CMS | cms:read, cms:write | Read and write |
| Sites | sites:read, sites:write | Read and write |
| Pages | pages:read, pages:write | Read and write |
| Assets | assets:read, assets:write | Read and write |
| Forms | forms:read | Read-only |
| Ecommerce | ecommerce:read, ecommerce:write | Read and write |
| Users | users:read, users:write | No access |
| Custom code | custom_code:read, custom_code:write | No access |
Ecommerce only appears on sites running an Ecommerce site plan.
Copy the token out of the dialog
Click Copy and paste the token somewhere safe, then click Done.
Your API token
Webflow reveals the token once. Close this dialog without copying and you have to generate a new one.
Paste the token into PopMCP
Open the Webflow connector in PopMCP, paste the value into API token, and save.
Connect in PopMCP
Open your workspace, choose Webflow in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| API tokensecret | In Webflow: Site settings → Apps & integrations → API access → Generate API token. Choose the scopes you need (e.g. CMS read/write, e-commerce, pages, forms). Copy the token (shown once) and paste it here. A workspace/Data-Client token that can see multiple sites works too. Stored encrypted; used server-side only.Encrypted with AES-256-GCM on save and never shown again. |
PopMCP verifies the credential against Webflow immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP shows Webflow as Connected and can list the site's CMS collections. The token's Last used value under Site settings, Apps & integrations, API access updates to today.
Troubleshooting
401 Unauthorized
Why: The token was mistyped, truncated when copied, or revoked.
Fix: Generate a fresh token under Site settings, Apps & integrations, API access, then paste the whole string with no leading or trailing spaces.
403 Forbidden on one tool only
Why: That API was left on No access when the token was created.
Fix: Webflow tokens cannot be re-scoped after creation. Revoke the token, generate a new one, and set the missing API to Read and write.
Generate API token is unavailable
Why: The site already holds 5 API tokens, which is the per-site maximum.
Fix: Revoke a token you no longer use in the API access list, then generate a new one.
Ecommerce permissions are not offered
Why: The site is not on an Ecommerce site plan.
Fix: Upgrade the site plan, or connect without the ecommerce tools.
429 Too Many Requests
Why: You passed the per-minute limit for the site's plan.
Fix: Slow the request rate. Starter and Basic sites allow 60 requests per minute, and CMS, Business and Ecommerce sites allow 120. Site publish is capped at one successful publish per minute.
A token that worked before now fails
Why: Site API tokens expire after 365 consecutive days of inactivity.
Fix: Generate a replacement token and update it in PopMCP.