Webflow setup

ConfigView reads your Webflow workspace and sites through the Webflow Data API (v2), using one API token that a Webflow workspace admin creates. ConfigView only reads. You will end up with 1 required secret (WEBFLOW_API_TOKEN) in ConfigView when setup is complete.

What this data is. Webflow is where your company builds and publishes its websites. ConfigView reads who has a seat in the workspace and in what role (including guests and clients), invitations that are pending, declined or expired, who holds which role on each site, your sites with their custom domains and last publish date, the webhooks registered on each site (host only), the workspace audit log (sign-ins, members added or removed, role changes, invitations, setting changes) and each site’s publishing activity. It never reads page content, CMS items, form submissions, assets, e-commerce data or custom code. ConfigView never creates, changes or deletes anything in Webflow.

What you need

Which token you can create decides what ConfigView can read:

Your Webflow plan	Token	What ConfigView reads
Enterprise workspace	A workspace token (workspace admins only)	Workspaces, members, invitations, site access, the audit log, and, where Webflow allows the token to, sites, custom domains, webhooks and site activity
Any other plan	A site token for one site	That site, its custom domains and its webhooks. Members, invitations, site access, the audit log and site activity are Enterprise features and are skipped

Members, invitations, site access, audit logs and site activity are Enterprise only. On any other plan those tables stay empty; that is expected and not a failure. A workspace token cannot call site-level endpoints (listing sites, webhooks), and a site token cannot call workspace endpoints. If you want both views, add two Webflow connections in ConfigView, one with each kind of token. Each connection reads what its token can reach.

Step 1: Open the Webflow page in ConfigView

Open ConfigView in a second browser tab and leave it open: https://{companyname}.configview.com/admin/integrations/webflow Webflow shows a token only once, when it is created, so paste it straight into ConfigView instead of keeping it in a notes file.

Step 2: Create a token

Enterprise workspace token

Sign in to Webflow as a workspace admin
In the left sidebar open Apps & integrations, then Manage, then scroll to Workspace API access
Click Generate API token, name it ConfigView, and set every scope to read only: workspace:read, workspace_members:read, site_access:read and workspace_activity:read, plus sites:read and site_activity:read if the list offers them
Generate it and copy it. You cannot see it again

Site token (other plans)

Open the site, then Site settings > Apps & integrations > API access
Click Generate API token, name it ConfigView, and grant read access to Sites (sites:read)
Copy it

A workspace holds at most 5 workspace tokens, and a workspace token expires after 365 days without being used. ConfigView calls the API every day, so it stays valid as long as the connection runs. If you delete it or let it lapse, create a new one: tokens cannot be regenerated. Switch to the ConfigView tab and paste it into WEBFLOW_API_TOKEN under Credentials, then click the save icon.

Step 3: Connect and verify

Back on https://{companyname}.configview.com/admin/integrations/webflow, confirm the credential shows as saved
Click Connect. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don’t want under Collectors:

Script	Notes
Workspaces	The workspaces the token reaches: name, slug and id.
Workspace Members	Everyone with a seat: name, email, workspace role, default site role and when they joined. Enterprise only.
Workspace Invitations	Invitations that are pending, declined or expired, with the role offered. Enterprise only.
Sites	Every site the token can see: workspace, custom domains, last published, last changed, locales.
Custom Domains	One row per custom domain on each site.
Site Members	Who holds which role on each site. One request per site. Enterprise only.
Webhooks	Webhooks registered on each site: event, receiving host, form, last fired. One request per site.
Workspace Audit Logs	The workspace audit log, kept permanently. Enterprise only.
Site Activity	Publishing and configuration activity per site, kept permanently. One request per site. Enterprise only.

Click Verify now. The health check proves the token with Webflow’s token introspection (which needs no scope), then tries one record from each area.

If a check fails:

Token introspection fails with 401. The token is wrong, was deleted, or expired from 365 days without use. Create a new one.
An area shows as skipped. Webflow answered “unauthorized”, “forbidden” or “not found” for it. Either the plan is not Enterprise, or this kind of token cannot reach it (a workspace token cannot list sites; a site token cannot read workspace members), or the scope was not granted. Nothing to fix unless you expected that area.

Data Tables

Once the scripts run, these tables are created in your database. Each table has a run_at column and a raw_json column holding the record as Webflow returned it, minus anything listed under What isn’t collected. The snapshot tables keep only the newest run. webflow_audit_logs and webflow_site_activity keep every event ever collected.

Table	Source	Key Columns
`webflow_workspaces`	`GET /v2/workspaces` (else `GET /v2/token/introspect`)	workspace_id, name, slug
`webflow_workspace_members`	`GET /v2/workspaces/{id}/members`	member_id, email, first_name, last_name, workspace_role, default_site_role, added_on
`webflow_workspace_invites`	`GET /v2/workspaces/{id}/members` (invites)	invite_id, email, role, invite_status, all_sites, site_count, created_on
`webflow_sites`	`GET /v2/sites`	site_id, workspace_id, display_name, custom_domains, last_published, last_updated
`webflow_custom_domains`	`GET /v2/sites` (each site’s custom domains)	domain_id, site_id, domain, last_published
`webflow_site_members`	`GET /v2/sites/{id}/members` (once per site)	member_id, site_id, email, workspace_role, site_role
`webflow_webhooks`	`GET /v2/sites/{id}/webhooks` (once per site)	webhook_id, site_id, trigger_type, url_host, form_name, last_triggered
`webflow_audit_logs`	`GET /v2/workspaces/{id}/audit_logs`	event_at, event_type, event_subtype, actor_email, target_user_email, site_slug, role_name, previous_role_name, method
`webflow_site_activity`	`GET /v2/sites/{id}/activity_logs` (once per site)	activity_id, site_id, event_at, event_name, user_name, resource_name

Things worth knowing

Roles. Workspace roles are owner, admin, member, guest, reviewer and client. Site roles are site manager, designer, branch designer, limited designer, marketer, content editor, reviewer, viewer or a custom role. Guests and clients are the outside people (agencies, freelancers, customers) you have let in. Joined date. added_on is when a member most recently joined. Role changes do not update it, and for an invited member it is the day they accepted. Invitations. Only pending invitations can still be accepted. Declined and expired ones are listed so you can see what was offered and never used. Audit log. The first run collects up to a year of audit events; later runs continue from the newest event stored. Webflow gives audit events no id, so ConfigView identifies each by a hash of its time, type, actor and details. Two identical events in the same second collapse into one row. Site activity. Only publishing, custom code, backup, branch, shared library and language events are kept. Style, layout, page content and CMS item edits are left out because of their volume. The first run reads up to 3,000 recent events per site; later runs stop as soon as they reach events already stored. Rate limits. Webflow allows 60 requests a minute per token on Starter and Basic, 120 on CMS, Ecommerce and Business, and a negotiated figure on Enterprise. ConfigView paces each script at 30 requests a minute. A workspace with many sites takes longer because members, webhooks and activity make one request per site.

What isn’t collected

Page content, CMS collections and items, assets, forms and form submissions, comments, e-commerce data
Custom code, and the before and after values and details of activity events (they can contain code or field values)
The full URL of each webhook: only its host is stored, because the path or query can act as a secret
Sign-in cookies, passwords and billing details
Installed apps: Webflow has no endpoint that lists them
The API token itself never goes into the database

Platform

Integrations

What you need

Step 1: Open the Webflow page in ConfigView

Step 2: Create a token

Step 3: Connect and verify

Data Tables

Things worth knowing

What isn’t collected

​What you need

​Step 1: Open the Webflow page in ConfigView

​Step 2: Create a token

​Step 3: Connect and verify

​Data Tables

​Things worth knowing

​What isn’t collected

What you need

Step 1: Open the Webflow page in ConfigView

Step 2: Create a token

Step 3: Connect and verify

Data Tables

Things worth knowing

What isn’t collected