Webflow CI and Agent Automation

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Webflow CLI non-interactive work must pass every required ID explicitly and should add --no-input; missing values fail instead of opening a usable prompt.
• Current apps management commands are on the CLI next channel. CI must pin an exact pre-release version rather than installing the moving tag.
• --json changes successful output, while errors remain human-readable stderr; gate primarily on exit status.
• Destructive app commands require --yes in non-interactive mode, and supported write-management commands provide --dry-run for previews.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Inventory existing workflows, branch protections, environment approvals, package locks, webflow.json, and the intended Webflow surface.
2. Pin Node and the exact SDK or CLI version. Pass app, environment, site, workspace, mount, and deployment mode explicitly.
3. Separate pull-request checks from protected-environment mutations. PR jobs should typecheck, test fixtures, and run read-only probes only.
4. For management writes, run the documented dry-run, archive the plan, and bind execution to an approved environment.
5. For Cloud deploys, wait for the deployment terminal status and run a route-specific smoke test before downstream notification.
6. Test missing secrets, wrong IDs, 429s, faile…

Webflow API Error Diagnosis

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Webflow error bodies expose code, message, externalReference, and details; preserve those fields after redaction.
• 400 is malformed input, 401 lacks valid authentication, 403 lacks permission, 404 misses the resource, and 409 conflicts with current state.
• 429 responses should honor Retry-After; official SDKs include exponential backoff.
• 5xx errors can be transient, but retries must be bounded and idempotent. Never replay an uncertain write blindly.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Capture the operation, endpoint family, HTTP status, Webflow code, request ID or headers, and a redacted error body.
2. Reproduce with the smallest read-only request using the same client configuration; do not paste bearer tokens into shell history.
3. Check site/resource IDs and staged/live or locale selection before changing authentication.
4. For 401/403, compare token type and exact endpoint scope. Rotate only when revocation or compromise is established.
5. For 429/5xx, classify read versus write, honor retry guidance, add jitter, and stop after a bounded attempt count.
6. Return a diagnosis with evidence, a minimal correction, and an explicit statement of whether any prior write may have succeeded.

Approval Boundaries

Default to read-only inspection. Before any create, update, delete,…

Webflow CMS Content Lifecycle

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Staged content is previewable but not necessarily live. Live items can retain unpublished staged changes.
• isDraft: true on an already-live item does not unpublish it. Unpublishing uses the live-item unpublish endpoint.
• Individual item publication and site-wide publication are separate operations. Scheduled publication cannot be controlled through the CMS API.
• Archiving retains an item in CMS and removes it from the live site on the next full-site publish; deletion is a different, destructive operation.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Verify site, collection, locale, field schema, and the current staged/live state before constructing changes.
2. Normalize source data against documented field types. Reject unknown fields and preserve item IDs and slugs for rollback.
3. Create or update staged items first. Produce a diff containing item ID, changed fields, prior live state, and intended result.
4. Validate a bounded sample in preview and check references, slugs, locale, asset IDs, and rich-text structure.
5. Ask for explicit approval naming item IDs before publish, unpublish, archive, delete, or site-wide publish.
6. After mutation, re-read the staged and live endpoints and record isDraft, isArchived, and lastPublished evidence.

Approval Boundaries

Default to read-only inspectio…

Webflow Site and Extended Data Operations

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Pages, components, forms, ecommerce, assets, custom code, and sites have separate endpoint families and scope pairs.
• Custom-code scopes are available to Data Client apps; site tokens cannot access custom-code endpoints.
• Form submissions and ecommerce records can contain personal or financial-adjacent data and require minimization before logs or fixtures.
• Site publishing is a separate write with an endpoint-specific limit and must not be coupled automatically to unrelated updates.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Classify the requested resource and operation; reject a kitchen-sink implementation plan that mixes unrelated writes.
2. Open the exact endpoint reference and record method, path, token eligibility, required scope, request fields, and pagination.
3. Inventory existing adapters and reuse their identity, error, retry, and redaction contracts.
4. Build a read-only probe first and verify the site and resource IDs returned.
5. For writes, produce a resource-specific diff and rollback or compensating action. Require explicit approval for the exact target.
6. Verify by re-reading the resource and report any downstream publish step separately.

Approval Boundaries

Default to read-only inspection. Before any create, update, delete, publish, unpublish, archive, deploy, token revoke, or webhook registration, show the ex…

Webflow Plan and Usage Tuning

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Pricing and plan entitlements change; never embed cached dollar figures or promise savings without current billing evidence.
• Site plan affects general Data API request limits, while endpoint and product entitlements can impose separate constraints.
• Cached Content Delivery reads effectively avoid API rate limits, but cache misses and bypasses still reach origin.
• Webhooks can replace polling for documented events; they do not eliminate reconciliation or every read workload.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Collect the current plan, invoices or usage exports the user provides, sites, traffic, API headers, deploy frequency, and workload schedule.
2. Separate fixed subscription choices from measured drivers such as origin calls, polling, asset traffic, build frequency, and external infrastructure.
3. Rank optimizations by evidence: remove unused calls, cache eligible live reads, subscribe to events, batch supported writes, and reduce duplicate deployments.
4. Check current official pricing and plan pages at decision time; label all forecasts with date, assumptions, and excluded charges.
5. Model baseline, expected range, implementation effort, reliability tradeoffs, and a rollback for each change.
6. Run one bounded experiment and compare measured usage and service quality before recommending a plan change.

Approval Boundaries

Defau…

Webflow Data Governance

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Form submissions and ecommerce payloads can contain direct identifiers, free text, addresses, and order data; treat schemas as sensitive until classified.
• Webflow scopes control API access but do not define your legal basis, retention period, or downstream processor obligations.
• Deletion, unpublishing, and archiving have different effects. A compliance workflow must target the correct resource and verify downstream copies.
• Generated examples are operational guidance, not legal advice; policy decisions require the organization's approved legal and security owners.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Inventory fields, event payloads, storage, logs, caches, exports, subprocessors, retention, and access roles for each data flow.
2. Classify required versus optional data and remove collection or persistence that the stated purpose does not need.
3. Redact sensitive fields before logs, traces, debug bundles, fixtures, and dead-letter queues.
4. Define access/export/delete requests as authenticated workflows with resource IDs, approvals, downstream propagation, and receipts.
5. Implement retention in each storage layer and test expiration plus legal-hold exceptions defined by policy.
6. Verify with synthetic data and report uncovered systems or unresolved policy choices to the accountable owner.

Approval Boundaries

Default to read-only ins…

Webflow Debug Evidence Bundle

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• A useful bundle identifies the SDK and CLI versions, API host, endpoint family, site ID, status, Webflow error code, and rate-limit headers.
• Tokens, OAuth codes, webhook secrets, authorization headers, form values, and ecommerce customer data must never enter the bundle.
• Content Delivery responses expose cf-cache-status; Data API responses expose rate-limit headers relevant to diagnosis.
• Bundle collection must be read-only. Token rotation, webhook replacement, and publishing are remediation actions, not diagnostics.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Inventory package manifests, lockfiles, webflow.json, environment-variable names, client construction, and recent relevant logs.
2. Extract versions and configuration names without reading or printing secret values.
3. Collect a minimal failed request description, structured error fields, response headers, timestamps, and retry count.
4. Record expected and observed site, collection, item, locale, and staged/live identities.
5. Redact secrets and personal data, then review the final bundle for authorization headers, tokens, emails, phones, addresses, and order data.
6. Package only after the user confirms the destination and retention policy; otherwise leave a local redacted report.

Approval Boundaries

Default to read-only inspection. Before any create, upda…

Webflow Cloud Deployment

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Webflow Cloud supports site-attached apps and standalone project apps; the first deployment inputs differ.
• Current app-management commands use the CLI apps namespace on the next channel, while stable CLI retains documented Cloud commands and deprecated aliases.
• Webflow recommends GitHub-linked deployment for the simple continuous-deployment path; linking the repository is a one-time dashboard operation.
• A deployment enqueue is not success. Wait for a terminal deployment status and verify the actual mounted route.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Inspect framework, build output, webflow.json, app/environment IDs, mount path, domain, and existing deployment history.
2. Choose site-attached or project-app mode and record all IDs. Discover IDs read-only; never infer them from names alone.
3. Pin the CLI channel/version and validate Node compatibility. Build and test locally using the project's own scripts.
4. Prepare the exact deploy command with explicit --no-input, target IDs, mount, environment, and any documented mount-path option.
5. Show rollback as a specific prior successful deployment or prior artifact, then obtain production approval.
6. Deploy, wait for terminal success, check domains and the mounted route, and retain the deployment ID and verification receipt.

Approval Boundar…

Webflow Enterprise Access Governance

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Webflow scopes authorize API resources; application roles are your application's policy and must not be presented as native Webflow role enforcement.
• Workspace tokens are suited to supported read-only multi-site monitoring and auditing, with workspace-activity scope documented separately.
• Site Activity and Workspace Activity APIs are enterprise surfaces with their own entitlements and scopes.
• Custom-code access requires a Data Client app; site tokens cannot call those endpoints.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Inventory Webflow workspace/site roles, application roles, token types, scopes, service identities, and every protected operation.
2. Create a role-to-operation matrix, then map each operation to exact Webflow endpoints and scopes. Mark application policy versus Webflow enforcement.
3. Use per-site tokens for controlled internal single-site services, OAuth grants for user-authorized multi-site apps, and workspace tokens only for supported workspace reads.
4. Add server-side authorization before API calls and verify the requested site belongs to the authenticated tenant or operator.
5. Collect activity evidence through entitled APIs and your own audit log without storing secret values or sensitive payloads.
6. Test denied operations, cross-site attempts, revoked grants, missing entitlements, and emergency access expiration.

Webflow Data API Hello World

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Start with GET /v2/sites; use the returned site ID to discover collections and other site resources.
• CMS has staged and live representations. A first-run example should read both deliberately rather than imply they are interchangeable.
• Connection success is not authorization for a write. Keep the hello-world path read-only until the user names the target collection and desired mutation.
• Use the target project's installed SDK types or the current endpoint reference because generated method names can change across SDK releases.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Inspect the project instructions, runtime, package manager, and existing environment-variable convention.
2. Add or reuse a pinned webflow-api dependency and a server-only WEBFLOW_API_TOKEN binding.
3. Create one small client module and a command that lists accessible sites without logging credentials or entire sensitive payloads.
4. Select the intended site by ID, then list collections and record their IDs and display names.
5. Read a bounded page of staged items and, separately, live items. Label which surface produced each result.
6. Run the project's typecheck or test command if already available; otherwise provide the exact command the user should run and the expected identity fields.

Approval Boundaries

Default to read-onl…

Webflow Incident Response

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• 401, 403, 429, and 5xx conditions require different action; rotating tokens is not a universal first response.
• An uncertain write must be reconciled by reading current resource state before retry.
• Webhook failures are retried only a bounded number of times and redirects, non-200s, TLS errors, and timeouts fail delivery.
• Cloud recovery must reference a specific deployment and terminal status; a previous successful deployment can be an explicit rollback target.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Declare severity, affected environment/sites, user impact, start time, incident owner, and whether live writes are frozen.
2. Check Webflow status and your own service independently; capture redacted structured errors, headers, deployment IDs, and webhook evidence.
3. Classify the failure: identity/auth, permission, budget, Webflow service, application, webhook, content state, or deployment.
4. Contain without guessing: pause workers, stop publication, serve an approved cached fallback, or isolate the failing tenant.
5. Apply one evidence-backed remediation with a rollback. Reconcile every uncertain write before resuming.
6. Verify read and write paths, staged/live state, webhook delivery, rate headroom, and public routes; record timeline and follow-up actions.

Approval Boundaries

Default to read-only inspection. Before any create, update, dele…

Webflow Install and Authentication

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Webflow Data API v2 accepts bearer tokens. Site tokens are for one site, workspace tokens are intended for read-only multi-site monitoring or auditing, and OAuth is for user-authorized or marketplace apps.
• Site tokens expire after 365 consecutive inactive days, a site can have up to five, and site tokens cannot call authorization, custom-code, or workspace-activity endpoints.
• Scopes are resource-specific. Determine them from the exact endpoints; do not copy a broad canned scope list.
• The official JavaScript SDK package is webflow-api. Resolve and pin the version from the target lockfile instead of embedding a floating latest command.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Classify the integration as single-site internal automation, read-only workspace monitoring, or a user-authorized app. Record the decision and excluded token types.
2. Inspect manifests, lockfiles, environment schemas, and existing clients. Identify the installed SDK and Data API version before editing.
3. Build an endpoint-to-scope table from the current official endpoint pages. Request read scopes unless a named write operation is required.
4. Store only environment-variable names and secret-manager references in source. Add .env* exclusions without creating sample values that resemble credentials.
5. Initialize one server-side client and add …

Webflow Local Development Loop

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Webflow CLI 2.x requires Node.js 22.13.0 or newer. Detect the installed version rather than silently upgrading it.
• Data API services, Webflow Cloud apps, and Designer extensions have different local commands and authentication boundaries; classify the project before scaffolding.
• CLI apps management commands are currently on @webflow/webflow-cli@next; stable CLI covers the documented stable surfaces.
• Tests should use fixtures or a dedicated non-production site. A developer token must never silently fall through to production.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Inventory the project and classify its Webflow surface from imports, webflow.json, scripts, and API hosts.
2. Record Node, package manager, SDK, and CLI versions. Pin the exact versions used by CI.
3. Create an environment schema that rejects a production site ID in local mode and never supplies fallback token values.
4. Capture representative API responses as redacted fixtures, preserving status, pagination, staged/live state, and locale shape.
5. Add unit tests for mapping and error handling plus an opt-in integration test against a named development site.
6. Document one fast loop: typecheck, unit test, local run, and optional integration smoke. Keep tunnels and public callbacks opt-in and time-bounded.

Approval Boundaries

Default t…

Webflow Content Migration

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Migration should target staged CMS content first; publication is a distinct operation with separate approval.
• Field types, references, assets, locales, slugs, draft state, and archive state must be mapped explicitly.
• Bulk limits and response shapes are endpoint-specific. Read the current create/update/publish endpoint instead of assuming a universal batch size.
• Webflow has no universal transaction rollback for a migration; preserve source snapshots, ID maps, and compensating unpublish/archive/delete plans.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Freeze and export the source with a checksum, record counts, identifiers, relationships, locales, assets, and content status.
2. Inspect target collection schemas and build an explicit source-to-Webflow field map with transformations and rejection rules.
3. Create a deterministic ID/slug map and validate a small fixture set without contacting production.
4. Import a bounded canary into staged state, preserving per-record receipts and never publishing automatically.
5. Compare counts, field values, references, asset availability, locales, and preview output; reconcile failures before the next batch.
6. After explicit approval naming the collection and item set, publish in bounded groups and verify live state; retain source and mapping evidence through the rollback window.

Approval Boundaries

Defaul…

Webflow Multi-Environment Setup

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Site IDs are identifiers, not secrets, but they still must be verified and allowlisted to prevent cross-environment writes.
• WEBFLOW_API_TOKEN is a read-only CLI input and is not resolved from webflow.json; app and environment IDs have documented resolution precedence.
• Flags override environment variables and manifest values. CI should pass target IDs explicitly even when a manifest exists.
• Separate sites and least-privilege tokens provide stronger isolation than naming conventions alone.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Inventory every environment, Webflow site/app/environment/workspace ID, domain, token owner, scope set, and deployment branch.
2. Create a typed mapping that requires an explicit environment and rejects unknown or mismatched IDs.
3. Store secret values only in the environment's secret manager; keep non-secret manifest IDs reviewed and versioned where appropriate.
4. Add guards that print target names and IDs—not secrets—and require production confirmation before live writes.
5. Use development fixtures and a staging site for integration tests; prohibit production fallbacks.
6. Verify each environment read-only and document promotion, rollback, token rotation, and emergency freeze procedures.

Approval Boundaries

Default to read-only inspection. Before any create, update, delete, pu…

Webflow Integration Observability

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Record HTTP status plus Webflow code, message, and bounded details; do not rely on exception text alone.
• Rate-limit headers and Retry-After explain request-budget pressure; Content Delivery adds cf-cache-status for cache behavior.
• Webhook registration exposes operational fields such as lastTriggered, while delivery health also depends on handler latency and deduplication.
• Webflow Cloud deployment and runtime logs are tied to app, environment, and deployment IDs; successful enqueue is not a deployment success metric.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Define service-level objectives for freshness, successful reads/writes, publish latency, webhook processing, and deployment availability.
2. Instrument request count, latency, status, error code, retry count, endpoint family, environment, and redacted site identity.
3. Track rate headroom and CDN HIT/MISS/BYPASS separately; avoid high-cardinality item IDs and personal data.
4. Measure webhook verification failures, age, duplicates, queue delay, handler duration, and last successful event by trigger.
5. For Cloud apps, correlate build/runtime logs and terminal deployment state with deployment IDs.
6. Add actionable alerts with owner, evidence link, safe first check, and a threshold based on observed baseline.

A…

Webflow Integration Performance

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• The Content Delivery API mirrors only documented read-only live-item endpoints at api-cdn.webflow.com; it is not a write or staged-content API.
• Cache TTL is currently 120 seconds for Enterprise plans and 300 seconds for other plans.
• cf-cache-status distinguishes HIT from MISS or BYPASS. Only cached responses effectively avoid plan rate limits; origin requests count.
• Data API pagination and bulk limits are endpoint-specific. Read the exact endpoint rather than assuming one universal batch size.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Measure endpoint, p50/p95 latency, payload size, pages, cache status, rate headers, worker concurrency, and freshness needs.
2. Route eligible published-item reads to Content Delivery with a dedicated read-only token and preserve Data API for fresh or staged data.
3. Cache only data with an explicit freshness budget; include site, collection, locale, query, and API surface in cache keys.
4. Bound pagination and concurrency below the observed per-key budget. Avoid fetching full collections when a delta or webhook can drive work.
5. Use supported bulk endpoints after validating their exact item limit and partial-failure behavior.
6. Load-test against fixtures or a non-production site and report latency, origin request reduction, staleness, and error rates.

Approval Boundaries

Defa…

Webflow Production Readiness

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Production readiness depends on the exact token type, endpoint scopes, site IDs, staged/live workflow, and plan limits—not a generic green health check.
• Readiness must test 401/403/429/5xx handling and uncertain-write reconciliation.
• CMS publish, unpublish, archive, delete, site publish, webhook replacement, and Cloud deploy are distinct live mutations.
• A rollback plan must name recoverable artifacts and compensating actions; Webflow does not provide a universal transaction rollback.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Freeze the release candidate and record dependency, SDK, CLI, schema, and configuration versions.
2. Verify production site and collection allowlists, token type, minimal scopes, secret ownership, and log redaction.
3. Exercise read-only smoke tests and failure-path tests against fixtures or a dedicated staging site.
4. Create a release plan listing every live mutation, target ID, expected result, validation query, and compensating action.
5. Obtain explicit approval for the named production targets, then execute one bounded canary if mutation was requested.
6. Verify live state, rate-limit headroom, webhook delivery, and monitoring; stop rollout on any mismatch.

Approval Boundaries

Default to read-only inspection. Before any create, update, delete, publish, unpublish, archive, deploy, token revoke, or webhook regist…

Webflow Rate-Limit Engineering

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Current general Data API budgets are 60 requests/minute for Starter and Basic, 120 for CMS, Ecommerce, and Business, and custom for Enterprise.
• Limits apply per API key. X-RateLimit-Limit, X-RateLimit-Remaining, and Retry-After expose the active budget.
• Site Publish is limited to one successful publish per minute; other endpoint-specific limits belong to their endpoint pages.
• Cached Content Delivery responses effectively avoid plan limits, but a MISS or BYPASS reaches origin and counts. Never call the CDN unlimited without that qualifier.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Identify site plan, API keys, worker count, endpoints, request volume, and whether operations are reads, idempotent writes, or publishes.
2. Measure actual headers in a secret-safe client log and distinguish per-key capacity from application-wide concurrency.
3. Set a conservative shared queue below the documented budget and reserve capacity for interactive or recovery work.
4. Honor Retry-After; otherwise use exponential backoff with jitter and a bounded attempt/deadline policy.
5. Replace polling with documented webhooks where suitable and use Content Delivery only for supported published-item reads.
6. Load-test against fixtures or a development site, then report sustainable throughput and failure…

Webflow Integration Reference Architecture

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Data API is the fresh read/write control plane; Content Delivery is a cached live-content read surface.
• Webhooks provide event signals but require authentication, idempotency, retries, and periodic reconciliation.
• Token type and site identity are architectural boundaries. A multi-tenant app should not share a broad internal token.
• CMS staging and publication are different states and should have separate application operations and approval policy.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Inventory actors, sites, locales, data classifications, freshness needs, write paths, event paths, and operational owners.
2. Draw trust boundaries for OAuth or site tokens, secret storage, Webflow APIs, queues, databases, logs, and public delivery.
3. Define adapters for Data API, Content Delivery, and webhook verification so SDK-generated contracts do not leak through the domain layer.
4. Separate read models, staged-write workflows, publication commands, and destructive operations.
5. Specify idempotency, reconciliation, rate budgets, cache policy, observability, and recovery for each data flow.
6. Validate the design with one happy path, one auth failure, one rate-limit event, one duplicate webhook, and one uncertain write.

Approval Boundaries

Default to read-only inspection. Before any create, update, delete, publish, unpublish, archiv…

Webflow SDK Patterns

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Webflow publishes official JavaScript and Python SDKs generated from the current API contract.
• Official SDKs include exponential backoff for rate-limit responses, but applications still need bounded work queues and business-level retry policy.
• The Content Delivery API can be selected with its documented base URL for cached live-item reads; it is not a general replacement for Data API writes.
• SDK return shapes and method names must come from the installed package types or current official reference, not remembered examples.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Locate every Webflow client construction and direct API call; group them by token, site, environment, and read/write intent.
2. Create one configuration boundary that validates the token variable name, API base URL, and expected site ID without logging values.
3. Wrap pagination as an iterator with explicit page and item limits. Preserve cursors or offsets exactly as returned.
4. Centralize error normalization around HTTP status, Webflow code, message, details, and retry headers.
5. Use a shared limiter for callers that share an API key. Let the official SDK backoff operate inside a bounded job policy.
6. Add contract tests against fixtures and one read-only integration smoke before migrating callers.

Approval Boundaries

Default to read-only inspe…

Webflow Integration Security

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Choose site token, read-only workspace token, or OAuth by integration type; do not emulate multi-tenancy by sharing one broad token.
• Site tokens have scope and endpoint limits, expire after 365 inactive days, and should be revoked immediately when compromised.
• API-created webhooks include x-webflow-timestamp and x-webflow-signature; dashboard-created webhooks do not include the headers needed for signature validation.
• Signing keys differ: qualifying site-token webhooks receive a webhook secret, while OAuth-created webhooks use the OAuth app client secret. Webflow recommends SDK verification.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Map data flows, token holders, sites, webhook destinations, log stores, CI, and every create/update/delete/publish path.
2. Build an endpoint-to-scope table and remove scopes that no current path requires.
3. Keep secrets server-side in a managed store; block authorization headers and sensitive webhook payloads from logs and traces.
4. For signed webhooks, preserve the request representation expected by the official verifier, validate signature and timestamp, and reject replays older than five minutes.
5. Require target identity, preview or diff, explicit approval, and post-write verification for live mutations.
6. Document revocation, rotation, incident ownership, and how to invalidate downstream se…

Webflow SDK and API Upgrade

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• Data API v2 is the default current contract; use Webflow's migration guide and exact endpoint references rather than a memorized method map.
• SDK package versions and generated method names change independently from your application adapter; inspect the installed and target package types.
• Webflow CLI 2.x requires Node.js 22.13.0 or newer and renames documented commands while retaining deprecated aliases temporarily.
• CLI app-management commands may require the next channel even when stable Cloud commands exist; record the exact installed channel and version.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Inventory API hosts, headers, SDK imports, generated methods, CLI commands, Node version, scopes, and staged/live assumptions.
2. Pin current and target versions and read their official migration notes. Build a call-site matrix with old contract, new contract, and test coverage.
3. Add characterization tests around pagination, errors, CMS state, locale behavior, webhook verification, and write idempotency.
4. Upgrade the adapter on a branch, then fix callers from compiler and test evidence rather than mass search-and-replace.
5. Run read-only integration smoke tests against a non-production site; preview any changed write payloads.
6. Obtain approval before production rollout and retain the prior lockfile, deployment artifact, and data reconcili…

Webflow Webhooks and Events

Overview

This skill produces a repo-grounded Webflow plan or implementation. It treats current official documentation and the target project's installed versions as authority, keeps discovery read-only, and separates preparation from live mutation.

Prerequisites

• A named target repository or project path and permission to inspect it
• The intended Webflow environment and non-secret resource identities, or a plan to discover them read-only
• Access to current official Webflow documentation; credentials stay in the user's existing secret store

Tool Discipline

Use Read for repository instructions and relevant files, Glob to inventory manifests and Webflow integration paths, and Grep to locate API hosts, IDs, scopes, and credential names. Use WebFetch only for current official Webflow documentation. Use Write for a new user-requested artifact and Edit for minimal changes to existing files after the evidence pass.

Current Contract

• API-created webhook requests include x-webflow-timestamp and x-webflow-signature; dashboard-created webhooks lack the headers needed for signature validation.
• The signature is SHA-256 HMAC over the documented timestamp/body representation. Webflow recommends its SDK verifier because the implementation may evolve.
• Qualifying site-token webhooks receive their own secret; OAuth-created webhooks use the OAuth app client secret.
• Webflow retries a failed delivery up to three additional times. Redirects, non-200 responses, TLS problems, and timeouts count as failures.

Authentication

Authenticate Data API calls with a bearer token selected for the integration: a site token for controlled single-site work, a workspace token only for its supported workspace/read use cases, or OAuth for user-authorized applications. Derive scopes from the exact endpoints. Never read, echo, persist, or place token values in commands, patches, examples, logs, or reports.

Workflow

1. Choose an official trigger type and determine its required scope from the create-webhook endpoint and event reference.
2. Make the HTTPS handler preserve the request representation required by the SDK verifier and reject missing headers.
3. Verify signature and timestamp before parsing sensitive data; reject requests older than the documented five-minute window.
4. Derive an idempotency key from stable event and payload identifiers, then enqueue work and return HTTP 200 quickly.
5. Redact form and ecommerce data in logs and set retention for payloads and deduplication keys.
6. Show the destination, trigger, site ID, auth mode, and rollback before registration; after approval, verify the stored webhook and a controlled test delivery…