Connecting your Webflow workspace
Site Health uses Webflow's OAuth flow for authorization. One click, read-only scopes, revocable anytime.
The OAuth flow
sequenceDiagram
participant U as You
participant S as Site Health
participant W as Webflow
U->>S: Click "Connect Webflow"
S->>W: Redirect to OAuth authorize
U->>W: Approve workspace access
W->>S: Redirect back with code
S->>W: Exchange code for access token
S->>W: List sites, pages
S->>U: Redirect to dashboard (sites synced)
What Site Health requests
| Scope | What it allows |
|---|---|
authorized_user:read | Your name + email (to create your Site Health account) |
sites:read | List of workspaces + sites |
pages:read | Published pages per site |
cms:read | CMS collections + items (for the image audit) |
No write scopes. Site Health literally cannot modify your Webflow content, pages, styles, or CMS.
What happens to your access token
- Encrypted at rest with AES-256-GCM before touching the database
- Never logged, never exposed in URLs, never sent to third parties
- Used only to fetch scan-target URLs and CMS metadata
- Revocable anytime from your Webflow integrations page
Multi-workspace support
Webflow lets you be an admin of multiple workspaces. When you OAuth:
- Webflow asks which workspace you want to connect
- Site Health syncs only the sites in the selected workspace
- To connect another workspace, click Disconnect on your dashboard, then Connect Webflow and pick a different workspace
Team/workspace access (invite other agency members to your Site Health workspace) is coming in v0.2 Phase 1.
Troubleshooting connection issues
"You don't have permission to authorize this app"
You're trying to connect a Webflow workspace you're not an admin of. Either:
- Get upgraded to admin by the current workspace owner, or
- Ask the admin to connect Site Health themselves, then invite you later
Sites didn't sync after connecting
Hit Sync Sites from the dashboard. OAuth sometimes needs a second sync, especially on first connection for large workspaces.
I revoked access from Webflow — what now?
Site Health's scans will start failing silently. Reconnect by going to /login and clicking Connect Webflow again.
I want to disconnect everything
On your dashboard, click Disconnect in the header. This:
- Deletes your Webflow connection from Site Health's database
- Deletes all sites connected via that connection (cascade)
- Deletes all scan data associated with those sites (cascade)
- Logs you out
You can reconnect at any time — you'll start fresh.
Reconnecting with a new token
If Webflow rotated your token or you accidentally disconnected:
- Go to /login
- Click Connect Webflow
- Select the same workspace — Site Health will recognize existing sites and refresh their stored tokens
No data is lost.