Fixing a Committed Webflow CLI API Token

So there you are happily building code components. You commit, and then suddenly realize that the .env was never gitignored, and is in the repo.

ℹ️ Written on win 11, adapt to Mac

in PowerShell from the repo root. It reads the token straight out of .env (so it never goes through me) and hits Webflow's token-introspect endpoint:

$t = ((Get-Content .env | Where-Object { $_ -match '^WEBFLOW_WORKSPACE_API_TOKEN=' }) -replace '^WEBFLOW_WORKSPACE_API_TOKEN=','').Trim()
curl.exe -s -o - -w "`nHTTP %{http_code}`n" -H "Authorization: Bearer $t" https://api.webflow.com/v2/token/introspect

Reading the result:

• HTTP 200 + a JSON body (workspace/scopes/authorization) → token is live and valid -- revoke it now.
• HTTP 401 (Unauthorized) → token is already dead/revoked -- nothing to rotate, you're clear.
• HTTP 429 → rate-limited, just rerun it.

If curl.exe isn't found for some reason, the pure-PowerShell equivalent:

$t = ((Get-Content .env | Where-Object { $_ -match '^WEBFLOW_WORKSPACE_API_TOKEN=' }) -replace '^WEBFLOW_WORKSPACE_API_TOKEN=','').Trim()
try { Invoke-RestMethod -Uri https://api.webflow.com/v2/token/introspect -Headers @{ Authorization = "Bearer $t" } | ConvertTo-Json -Depth 5 }
catch { "HTTP $($_.Exception.Response.StatusCode.value__) - $($_.Exception.Response.StatusCode)" }

The Result

You'll see a clear result in JSON, which will clearly indicate if the token is still valid. If it is, you need to revoke it on the Webflow side.

Go to the integrations pane in your workspace, will look like;

https://webflow.com/dashboard/workspace/YOUR-WORKSPACE-SLUG/integrations

Find the Webflow CLI app, and revoke probably all tokens.

You can keep the app itself installed

Notes

I didn't see an obvious way to see or identify a partial token, and visually match to surgically revoke the specific token I wanted to rotate.

That's annoying but it is what it is.