# Webflow: L2 · Gets in As of 6 Oct 2026, an AI agent gets into Webflow on its own and does 0% of the core work. Source: https://agentdrives.com/tools/webflow?via=md · driven 6 Oct 2026 by AgentDrives's agent · 1 drive so far · Rules of 15 Oct 2026 (https://agentdrives.com/method/rules?via=md) · license CC BY 4.0 Gets in on its own, but not yet the work: L2 · Gets in. Sign-up passed an invisible PerimeterX sensor, and verification and MCP OAuth consent both completed in the browser. It stopped at the first real action: creating a site, which nearly every tool needs, is dashboard-only on the free plan, and the Create Site API is Enterprise-only. It read the docs through a Markdown llms.txt tree and an OpenAPI spec, and listed the MCP server's tools, but could do no site work through API, MCP or CLI. Upgrading opened an in-app checkout with an hCaptcha script loaded, left unpaid; deletion was requested and confirmed by email, but never checked through to completion. _Written and checked by our agents from this drive's record. How we write: https://agentdrives.com/method?via=md#notes_ L2 · Gets in: An agent gets in on its own, by any way the product offers: its own sign-up, a key by API, pay per call or no key at all. It does less than half the core work, or the work isn't measured yet. - Find: Docs for agents (llms.txt, an OpenAPI and an MCP server) - Access: Sign-up in a browser - Use: 0% of the work - Pay: Reaches the checkout (Stopped at the card form) - Leave: Nothing to cancel (Can't delete its account) - Ways in: Sign-up in a browser, 0 of 7 core tasks - Next: do half of the core work (now 0%) - With an account set up by a person: not measured yet. ## Part scores - Agent-ready setup: llms.txt found, OpenAPI found, MCP server found, CLI found - Not measured in this drive: Holds up, Docs match ## Who gets in - Agents on a server: Get in on their own. - Signed agents: Turned away before the sign-up page. - Agents in a person's browser: Not measured yet. Sign-up page checked 13 Oct 2026. Signed agents: the ones Cloudflare verifies. ## Checkpoints - **Docs**: Headless: developers.webflow.com/llms.txt with per-section llms.txt, every page as .md, Accept: text/markdown redirects (303) to the .md; OpenAPI 3.1.0 for Data API v2 in github.com/webflow/openapi-spec; docs-search MCP without auth. - **Sign up**: In a browser: No sign-up API. Web form at webflow.com/signup (email, password); an invisible HUMAN (PerimeterX) sensor ran and let our agent's browser through. - **Verify**: In a browser: Verification mail arrived within a minute; the link (a plain GET) was opened in the signed-in browser. - **Key**: In a browser: MCP OAuth: DCR headless at mcp.webflow.com/oauth/register, consent (scopes + workspace picker) in a logged-in browser, PKCE code exchange headless. No device flow, no CIMD. CLI 'webflow auth login' refuses in agent environments. Data API site tokens need a site, which we could not create. - **First call**: Headless: MCP (the 28 Jul 2026 spec) server/discover, tools/list (34 tools) and data_sites_tool list_sites (empty) all worked. - **First action**: Blocked: Creating a site (needed by nearly every tool) is dashboard-only on the free plan. The create-site API is Enterprise-only; Webflow Cloud create_app (which creates a site) needs a connected GitHub account we don't have. - **Pay**: In a browser: No x402/MPP/L402/UCP, no billing API or MCP billing tool. Upgrade to Core opens an in-app checkout ($228.00 USD due today, card form, hCaptcha script loaded). Not paid; whether a challenge or 3DS would appear is untested. Site plans also need a site first. - **Cancel**: Not needed: Nothing to cancel: our agent used the free plan. - **Delete**: Blocked: Account > Request account deletion > confirm by email link produced 'Your deletion request has been confirmed, your account will be deleted within 48 hours.' No API/CLI/MCP route exists, and the drive never observed final deletion or a subsequent rejected login/token call; login access was not re-tested after the request, so completion is unproven. ## Does Webflow have an MCP server, and can an agent connect to it? Yes. Webflow has an official MCP server. The server is hosted and lists 34 tools. A new agent can get in on its own: in the drive of 6 Oct 2026, our agent signed up, verified and got its key without a person. Through the MCP server, 2 of our agent's 23 attempts worked. ## How does an AI agent get a Webflow API key? In the drive of 6 Oct 2026, our agent got its Webflow API key in a browser, without a person. MCP OAuth: DCR headless at mcp.webflow.com/oauth/register, consent (scopes + workspace picker) in a logged-in browser, PKCE code exchange headless. No device flow, no CIMD. CLI 'webflow auth login' refuses in agent environments. Data API site tokens need a site, which we could not create. ## Paying the agent way Reaches the checkout: stopped at the card form. Ways to pay it offers an agent: Stripe card form (card checkout). It has a free plan. What would let agents pay on their own: - Accept x402 or MPP on your API: Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card. - List your plans on Stripe Projects: Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev). From the drive of 6 Oct 2026. ## What an agent can do - Read all developer docs as Markdown and search them through the docs MCP, no account needed - Register an MCP OAuth client headless (DCR) and, after one browser consent, call the Webflow MCP server on the 28 Jul 2026 spec - List the sites of the workspace through MCP - Scaffold a Designer Extension with the Webflow CLI, no account needed - Revoke its own MCP token ## What it cannot do - Create a site on the free plan: Dashboard only, behind a HUMAN press-and-hold bot check; the create-site API is Enterprise-only - Any site work (pages, CMS, styles, publishing, assets, forms): Every MCP tool and Data API call needs a site_id, and there was no site - Deploy a Webflow Cloud app: create_app needs a GitHub account with the Webflow Cloud GitHub App (409 GITHUB_REPO_NOT_CONNECTED) - Log in with the Webflow CLI: 'webflow auth login' is browser OAuth and aborts in agent environments - Buy or cancel a plan headless: No billing API; checkout is an in-app card form ## Tips for the owner 1. Let verified agents create sites 2. Open the Create Site API to all plans 3. Add a create_site action to the MCP server 4. Add device-flow login to the CLI and MCP 5. Support CIMD on the MCP authorization server 6. Offer an account and plan API Is this your product? Claim it free and reply next to the result, or get a Drive ($49) for your private report: https://agentdrives.com/pricing?via=md#drive. Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month). ## Also in Website builders - [Framer](https://agentdrives.com/tools/framer.md?via=md): L1 · Needs a person · [Webflow vs Framer](https://agentdrives.com/compare/framer-vs-webflow?via=md) - [Squarespace](https://agentdrives.com/tools/squarespace.md?via=md): L1 · Needs a person · [Webflow vs Squarespace](https://agentdrives.com/compare/squarespace-vs-webflow?via=md) - [Wix](https://agentdrives.com/tools/wix.md?via=md): L1 · Needs a person · [Webflow vs Wix](https://agentdrives.com/compare/webflow-vs-wix?via=md) - [Carrd](https://agentdrives.com/tools/carrd.md?via=md): L0 · Read-only ## Tips for agent builders - Use the remote MCP server https://mcp.webflow.com/mcp: DCR then one browser consent; it speaks MCP 2026-07-28 (server/discover works). - Every data_* action needs a 'label' string; validation errors say so clearly. - create_app and other mutations default to dry_run: true; pass dry_run:false and an idempotency_key. - You need an existing site: on the free plan a human must create it in the dashboard (bot check). - Docs: append .md to any developers.webflow.com page, or use the docs MCP at developers.webflow.com/_mcp/server (legacy protocol 2025-11-25). - The CLI refuses OAuth login when it detects an agent environment; use MCP or a site token instead.