> ## Documentation Index > Fetch the complete documentation index at: https://support.configview.com/llms.txt > Use this file to discover all available pages before exploring further. # Webflow setup ConfigView reads your Webflow workspace and sites through the Webflow Data API (v2), using one **API token** that a Webflow workspace admin creates. ConfigView only reads. You will end up with **1 required secret** (`WEBFLOW_API_TOKEN`) in ConfigView when setup is complete. > **What this data is.** Webflow is where your company builds and publishes its websites. ConfigView reads who has a seat in the workspace and in what role (including guests and clients), invitations that are pending, declined or expired, who holds which role on each site, your sites with their custom domains and last publish date, the webhooks registered on each site (host only), the workspace audit log (sign-ins, members added or removed, role changes, invitations, setting changes) and each site's publishing activity. It never reads page content, CMS items, form submissions, assets, e-commerce data or custom code. ConfigView never creates, changes or deletes anything in Webflow. *** ## What you need Which token you can create decides what ConfigView can read: | Your Webflow plan | Token | What ConfigView reads | | - | - | - | | **Enterprise workspace** | A **workspace token** (workspace admins only) | Workspaces, members, invitations, site access, the audit log, and, where Webflow allows the token to, sites, custom domains, webhooks and site activity | | **Any other plan** | A **site token** for one site | That site, its custom domains and its webhooks. Members, invitations, site access, the audit log and site activity are Enterprise features and are skipped | Members, invitations, site access, audit logs and site activity are **Enterprise only**. On any other plan those tables stay empty; that is expected and not a failure. A workspace token cannot call site-level endpoints (listing sites, webhooks), and a site token cannot call workspace endpoints. If you want both views, add two Webflow connections in ConfigView, one with each kind of token. Each connection reads what its token can reach. *** ## Step 1: Open the Webflow page in ConfigView Open ConfigView in a second browser tab and leave it open: `https://{companyname}.configview.com/admin/integrations/webflow` Webflow shows a token only once, when it is created, so paste it straight into ConfigView instead of keeping it in a notes file. *** ## Step 2: Create a token **Enterprise workspace token** 1. Sign in to Webflow as a workspace admin 2. In the left sidebar open **Apps & integrations**, then **Manage**, then scroll to **Workspace API access** 3. Click **Generate API token**, name it `ConfigView`, and set every scope to **read only**: `workspace:read`, `workspace_members:read`, `site_access:read` and `workspace_activity:read`, plus `sites:read` and `site_activity:read` if the list offers them 4. Generate it and copy it. You cannot see it again **Site token (other plans)** 1. Open the site, then **Site settings** > **Apps & integrations** > **API access** 2. Click **Generate API token**, name it `ConfigView`, and grant read access to **Sites** (`sites:read`) 3. Copy it A workspace holds at most 5 workspace tokens, and a workspace token expires after 365 days without being used. ConfigView calls the API every day, so it stays valid as long as the connection runs. If you delete it or let it lapse, create a new one: tokens cannot be regenerated. Switch to the ConfigView tab and paste it into `WEBFLOW_API_TOKEN` under **Credentials**, then click the save icon. *** ## Step 3: Connect and verify 1. Back on `https://{companyname}.configview.com/admin/integrations/webflow`, confirm the credential shows as saved 2. Click **Connect**. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don't want under **Collectors**: | Script | Notes | | - | - | | **Workspaces** | The workspaces the token reaches: name, slug and id. | | **Workspace Members** | Everyone with a seat: name, email, workspace role, default site role and when they joined. Enterprise only. | | **Workspace Invitations** | Invitations that are pending, declined or expired, with the role offered. Enterprise only. | | **Sites** | Every site the token can see: workspace, custom domains, last published, last changed, locales. | | **Custom Domains** | One row per custom domain on each site. | | **Site Members** | Who holds which role on each site. One request per site. Enterprise only. | | **Webhooks** | Webhooks registered on each site: event, receiving host, form, last fired. One request per site. | | **Workspace Audit Logs** | The workspace audit log, kept permanently. Enterprise only. | | **Site Activity** | Publishing and configuration activity per site, kept permanently. One request per site. Enterprise only. | 3. Click **Verify now**. The health check proves the token with Webflow's token introspection (which needs no scope), then tries one record from each area. If a check fails: * **Token introspection fails with 401.** The token is wrong, was deleted, or expired from 365 days without use. Create a new one. * **An area shows as skipped.** Webflow answered "unauthorized", "forbidden" or "not found" for it. Either the plan is not Enterprise, or this kind of token cannot reach it (a workspace token cannot list sites; a site token cannot read workspace members), or the scope was not granted. Nothing to fix unless you expected that area. *** ## Data Tables Once the scripts run, these tables are created in your database. Each table has a `run_at` column and a `raw_json` column holding the record as Webflow returned it, minus anything listed under *What isn't collected*. The snapshot tables keep only the newest run. `webflow_audit_logs` and `webflow_site_activity` keep every event ever collected. | Table | Source | Key Columns | | - | - | - | | `webflow_workspaces` | `GET /v2/workspaces` (else `GET /v2/token/introspect`) | workspace\_id, name, slug | | `webflow_workspace_members` | `GET /v2/workspaces/{id}/members` | member\_id, email, first\_name, last\_name, workspace\_role, default\_site\_role, added\_on | | `webflow_workspace_invites` | `GET /v2/workspaces/{id}/members` (invites) | invite\_id, email, role, invite\_status, all\_sites, site\_count, created\_on | | `webflow_sites` | `GET /v2/sites` | site\_id, workspace\_id, display\_name, custom\_domains, last\_published, last\_updated | | `webflow_custom_domains` | `GET /v2/sites` (each site's custom domains) | domain\_id, site\_id, domain, last\_published | | `webflow_site_members` | `GET /v2/sites/{id}/members` (once per site) | member\_id, site\_id, email, workspace\_role, site\_role | | `webflow_webhooks` | `GET /v2/sites/{id}/webhooks` (once per site) | webhook\_id, site\_id, trigger\_type, url\_host, form\_name, last\_triggered | | `webflow_audit_logs` | `GET /v2/workspaces/{id}/audit_logs` | event\_at, event\_type, event\_subtype, actor\_email, target\_user\_email, site\_slug, role\_name, previous\_role\_name, method | | `webflow_site_activity` | `GET /v2/sites/{id}/activity_logs` (once per site) | activity\_id, site\_id, event\_at, event\_name, user\_name, resource\_name | *** ## Things worth knowing **Roles.** Workspace roles are owner, admin, member, guest, reviewer and client. Site roles are site manager, designer, branch designer, limited designer, marketer, content editor, reviewer, viewer or a custom role. Guests and clients are the outside people (agencies, freelancers, customers) you have let in. **Joined date.** `added_on` is when a member most recently joined. Role changes do not update it, and for an invited member it is the day they accepted. **Invitations.** Only *pending* invitations can still be accepted. Declined and expired ones are listed so you can see what was offered and never used. **Audit log.** The first run collects up to a year of audit events; later runs continue from the newest event stored. Webflow gives audit events no id, so ConfigView identifies each by a hash of its time, type, actor and details. Two identical events in the same second collapse into one row. **Site activity.** Only publishing, custom code, backup, branch, shared library and language events are kept. Style, layout, page content and CMS item edits are left out because of their volume. The first run reads up to 3,000 recent events per site; later runs stop as soon as they reach events already stored. **Rate limits.** Webflow allows 60 requests a minute per token on Starter and Basic, 120 on CMS, Ecommerce and Business, and a negotiated figure on Enterprise. ConfigView paces each script at 30 requests a minute. A workspace with many sites takes longer because members, webhooks and activity make one request per site. ## What isn't collected * Page content, CMS collections and items, assets, forms and form submissions, comments, e-commerce data * Custom code, and the before and after values and details of activity events (they can contain code or field values) * The full URL of each webhook: only its host is stored, because the path or query can act as a secret * Sign-in cookies, passwords and billing details * Installed apps: Webflow has no endpoint that lists them * The API token itself never goes into the database This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.