Connecting accounts
Synclify connects to Webflow and Airtable over OAuth. You authorize on the provider’s own site — Synclify never sees or stores your provider password. Webflow scopes. Synclify requestscms:read and cms:write. That’s read and write access to CMS collections and items. It does not request access to your Designer layouts, pages, site settings, billing, or account.
Revoking access. Revoke Synclify from your Webflow or Airtable account settings at any time. The connected account then shows reauth required in Synclify and syncs stop until you reconnect.
OAuth integrity
Every OAuth handshake carries a one-time randomstate value that Synclify generates and verifies on return. If the value coming back doesn’t match the one sent, Synclify rejects it:
Invalid OAuth state. Please try again.This prevents an attacker from tricking your browser into completing an authorization Synclify didn’t initiate (CSRF). Redirects after sign-in are validated too — Synclify only follows relative paths inside the app, never an external URL smuggled into a redirect parameter.
Your account
- Sign in with email and password (minimum 12 characters), a one-time emailed link, or Google OAuth.
- Your session is a cookie, protected against cross-site request forgery. No bearer token is held in browser storage where a script could read it.
- Signing out resets the app: every store returns to its initial state, cached data is dropped, and Synclify’s local storage is cleared. The next person to use the browser sees nothing of your workspace.
- Two-factor authentication is available, and applies to password, emailed-link, and Google sign-in alike. See Security settings.
- If a request ever comes back unauthorized, Synclify clears your session immediately and returns you to sign-in.
Data handling
- Airtable — Synclify reads the bases and tables you grant, at sync time. It reads row values to push them to Webflow (and, on two-way connections, writes values back).
- Webflow — Synclify reads your collection schemas and reads/writes CMS items.
- Synclify syncs the fields you map. Unmapped columns are not read into Webflow.
Safe writes
- Nothing is written without a preview. A new connection stays an inert draft until you approve a full preview of the first sync. See Guided setup.
- Deletes are opt-in twice. Delete propagation is off by default, and turning it on requires both a toggle and an explicit acknowledgement that counterpart records can be deleted. A stored policy Synclify cannot interpret fails closed rather than guessing. See Sync settings.
- Deletes are recoverable for a window. A deleted record is kept as a tombstone and can be restored during its retention period. See Deleted records.
- Idempotency. Every change Synclify sends carries an idempotency key, so a retried request can’t accidentally apply the same change twice.
- Destructive actions are gated. Archiving a connection requires typing its exact name plus a written reason. Disconnecting a provider account additionally requires a step-up identity check — your current password, or an authenticator or recovery code — and an exact typed confirmation. See Manage data sources.
- You can stop everything. Workspace kill switches block all syncing, automatic syncing, or reverse syncing, each requiring a reason that is written to the audit log. See Security settings.