webflow-webhooks
Enables the receipt and verification of Webflow webhooks for various events, enhancing integration and automation capabilities.
Install this skill
Security score
The webflow-webhooks skill was audited on Mar 8, 2026 and we found 25 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 40 | const signedContent = `${timestamp}:${rawBody}`; |
Webhook reference - potential data exfiltration
| 2 | name: webflow-webhooks |
Webhook reference - potential data exfiltration
| 3 | description: Receive and verify Webflow webhooks. Use when setting up Webflow webhook handlers, debugging signature verification, or handling Webflow events like form_submission, site_publish, ecomm_n |
Webhook reference - potential data exfiltration
| 8 | url: "https://skills.224ai.au/webflow-webhooks.skill" |
Webhook reference - potential data exfiltration
| 10 | keywords: "ai, agent, skill, webhooks, signature verification, webflow, form submission, site publish, ecomm order, collection item" |
Webhook reference - potential data exfiltration
| 13 | # Webflow Webhooks |
Webhook reference - potential data exfiltration
| 15 | Receive, verify, and process Webflow webhook events for form submissions, CMS changes, ecommerce orders, site publishing, and more. |
Webhook reference - potential data exfiltration
| 19 | > **Prerequisite:** You need a Webflow account with an active site. For signature verification, create webhooks via the API (not the dashboard) — see [Setup](references/setup.md). |
Webhook reference - potential data exfiltration
| 21 | 1. **Create webhook**: Register a webhook via the Webflow API for your desired event type |
Webhook reference - potential data exfiltration
| 61 | app.post('/webhooks/webflow', express.raw({ type: 'application/json' }), (req, res) => { |
Webhook reference - potential data exfiltration
| 73 | process.env.WEBFLOW_WEBHOOK_SECRET |
Webhook reference - potential data exfiltration
| 103 | Webflow supports 14 webhook event types across 6 categories: Forms, Site, Pages, Ecommerce, CMS, and Comments. See **[references/event-types.md](references/event-types.md)** for the complete reference |
Webhook reference - potential data exfiltration
| 117 | # For webhooks created via OAuth App |
Webhook reference - potential data exfiltration
| 118 | WEBFLOW_WEBHOOK_SECRET=your_oauth_client_secret |
Webhook reference - potential data exfiltration
| 120 | # For webhooks created via API (after April 2025) |
Webhook reference - potential data exfiltration
| 121 | WEBFLOW_WEBHOOK_SECRET=whsec_xxxxx # Returned when creating webhook |
Webhook reference - potential data exfiltration
| 126 | 1. **Always verify signatures**: Use HMAC-SHA256 verification for webhooks created via OAuth or API — see [Verification](references/verification.md) |
Webhook reference - potential data exfiltration
| 131 | 6. **Use HTTPS in production**: Webhook endpoints must use HTTPS for security |
Webhook reference - potential data exfiltration
| 135 | - **Never handle secrets in plain text.** API tokens, OAuth client secrets, and webhook signing secrets must always be stored in environment variables or a secrets manager. Never ask the user for toke |
Webhook reference - potential data exfiltration
| 136 | - Webhooks created through the Webflow dashboard do NOT include signature headers |
Webhook reference - potential data exfiltration
| 137 | - Only webhooks created via OAuth apps or API include `x-webflow-signature` and `x-webflow-timestamp` |
Webhook reference - potential data exfiltration
| 146 | - **[references/webhook-api.md](references/webhook-api.md)**: REST API v2 endpoints for creating, listing, getting, and deleting webhooks |
Webhook reference - potential data exfiltration
| 147 | - **[references/overview.md](references/overview.md)**: Webhook concepts, delivery behavior, limits, and security considerations |
Access to .env file
| 73 | process.env.WEBFLOW_WEBHOOK_SECRET |
External URL reference
| 8 | url: "https://skills.224ai.au/webflow-webhooks.skill" |
Install this skill with one command
/learn @224-industries/webflow-webhooks