Webflow Forms

Sequenzy is a Webflow Data Client integration. It reads native form schemas through Webflow’s Forms API and receives selected form submissions through signed, form-filtered Webflow webhooks. It does not ask you to paste HTML, React, JavaScript, custom code, or a direct-to-Sequenzy form action into Webflow.

OAuth authorization does not start capture. Sequenzy fails closed until an administrator explicitly selects a native form, its allowed fields, a consent policy, and enrollment settings.

Connect And Configure

Install Sequenzy from the Webflow Marketplace, or open Settings → Integrations → Websites & Forms → Webflow → Connect.
Review the requested scopes in Webflow. Choose only the sites or workspace Sequenzy should be authorized to read, then approve the connection.
Back in Sequenzy, open Webflow → Select forms.
Select each native form Sequenzy may process. Unselected forms are excluded.
For each selected form:
- confirm the native Email field;
- allow only the additional fields Sequenzy needs;
- review the required Sequenzy double opt-in policy.
Choose explicit list enrollment. No lists is the default.
Leave Run eligible sequences off unless submissions should start configured automations.
Save. Sequenzy creates one form_submission webhook filtered to each selected form name.

Only workspace owners and admins can connect or reconfigure Webflow. Existing submissions are not imported.

Form And Field Selection

Sequenzy uses GET /v2/sites/{siteId}/forms to show the native forms returned by Webflow. A form is processed only when its Webflow form ID and site ID match a saved capture rule.

Unselected sites and forms are rejected.
Removing a selected form reconciles and removes its Sequenzy-owned webhook.
Clearing every selection turns capture off and removes the integration’s webhooks.
Duplicate form names on one site cannot be selected because Webflow’s webhook filter is name-based. Rename the forms in Webflow, then use Refresh from Webflow to load the current schema.
Forms without a native Email field cannot be selected.
Password, passcode, credential, authentication-token, and secret fields are never selectable.
Use Refresh from Webflow after publishing or changing a native form. Refresh removes every saved selection and webhook, then leaves capture off until an administrator reviews the new schema and saves exact rules again. It also clears destination lists and turns off sequence enrollment, so review those settings before saving. The form-selection screen shows Schema last fetched beside the refresh control and flags forms with duplicate names.

Webflow sends the selected form’s submission to the webhook. After signature verification, Sequenzy immediately applies your field allowlist. Excluded fields are discarded before a background job is queued and are not stored by Sequenzy. A Webflow submission is not marketing consent by itself. Every selected form uses Sequenzy double opt-in. A valid submission creates a pending contact and queues the confirmation email; the contact cannot receive marketing email until they confirm. Sequenzy does not infer consent from a Webflow submission or from an undocumented field type. List enrollment and sequence enrollment are separate controls:

New connections default to No lists.
Selecting one or more lists adds accepted contacts only to those lists.
Run eligible sequences defaults to off.
Event automations do not run while the contact is pending. Eligible contact/list automations run only after confirmation and only when Run eligible sequences is enabled.

Changing these controls affects future submissions. It does not remove an existing contact or list membership.

Data Flow And Storage

Form schemas are snapshots from Webflow as of Schema last fetched. Captured submissions are historical copies of the allowed fields at capture time, not a live view of Webflow. Consent status, list membership, and sequence enrollment are managed in Sequenzy. Consent metadata on a submission event describes that event, not the subscriber’s current consent status. Later changes or deletions of submissions, forms, or sites in Webflow do not automatically update or delete subscribers or events already captured in Sequenzy. Disconnecting stops capture but does not delete those records. Delete subscribers in Sequenzy: deleting a subscriber also deletes their captured events, usually within an hour. Deleting the workspace deletes all of them.

Stage	Data handled	Retention and behavior
OAuth	Encrypted access token; authorization, user, site, native-form schema, and customer-owned custom-domain metadata	Kept while connected. Used only for the Webflow integration and deleted after successful disconnect cleanup.
Webhook verification	Raw request body, `x-webflow-signature`, and `x-webflow-timestamp`	Used in request memory to verify the HMAC and five-minute timestamp window. Invalid, expired, future-dated, and replayed deliveries are rejected or safely acknowledged without processing.
Consent and filtering	Selected form metadata and configured field allowlist	Applied synchronously. Unconfigured forms, excluded fields, invalid configured emails, and sensitive/password fields do not enter the job queue. Accepted contacts remain pending until double opt-in confirmation.
Background job	Only selected field values plus site, form, submission, and submitted-at identifiers	Successful jobs are removed within 24 hours; failed jobs within 7 days, with count limits as an additional bound.
Subscriber	Email, detected first/last name when allowed, consent metadata, and selected list membership	Kept until the subscriber or workspace is deleted, subject to the privacy policy and legal obligations.
`webflow.form_submission` event	Site/form/submission metadata and the allowed fields under `formData`	Stored in Sequenzy’s subscriber-event store until the subscriber or workspace is deleted.
Replay keys	A hash derived from delivery metadata and the Webflow submission ID	Delivery keys expire after 10 minutes. Processed submission IDs expire after 30 days. The raw signature is not stored in the key.

Sequenzy does not publish or modify Webflow pages, Designer elements, form markup, CMS content, assets, custom code, or site styles. The integration adds no fonts, images, third-party asset requests, or “Powered by Sequenzy” link to the published site. While Webflow is connected, Sequenzy also disables its custom form and popup embed code and rejects submissions to previously deployed Sequenzy embed endpoints for that workspace. This policy is enforced by the public API, not only hidden in the dashboard.

Event Shape

Accepted submissions record webflow.form_submission. Only fields selected in the allowlist appear under formData:

{
  "provider": "webflow",
  "webflowTriggerType": "form_submission",
  "webflowSiteId": "65427cf400e02b306eaa049c",
  "webflowFormId": "65429eadebe8a9f3a30f62d0",
  "webflowFormName": "Newsletter",
  "webflowSubmissionId": "6321ca84df3949bfc6752327",
  "webflowSubmittedAt": "2026-08-20T12:35:16.117Z",
  "webflowConsentMode": "double_opt_in",
  "webflowConsentStatus": "pending_double_opt_in",
  "webflowConsentRequestedAt": "2026-08-20T12:35:16.117Z",
  "formData": {
    "Email": "ari@example.com",
    "First Name": "Ari"
  }
}

Security And Ownership

For every delivery, Sequenzy:

verifies x-webflow-signature over the timestamp and exact raw body using the Webflow app secret;
rejects timestamps older than five minutes or more than 30 seconds in the future;
claims short-lived delivery and submission replay keys before queueing;
requires an active local integration and an exact saved form/site rule;
re-introspects the OAuth token in the worker and verifies the site or workspace is still authorized immediately before any subscriber write;
uses a stable Webflow submission event ID so worker retries cannot create a second event.

If Webflow authorization is revoked or the site is no longer authorized, the worker deactivates the integration and stops processing before data mutation. For a still-valid but narrowed authorization, it queues the same cleanup used by an explicit disconnect. For a revoked token, it deletes the credential immediately, keeps the incomplete cleanup visible, and shows the manual path below because the Webflow API can no longer be called.

Custom Domains And Sending Domains

Sequenzy reads customer-owned domains from Webflow’s Custom Domains API for site context and domain suggestions. It never suggests a *.webflow.io staging domain as a sending domain. You can still enter another domain manually, but you must own and verify it before sending. Your workspace may initially use a Sequenzy default sending domain. You can use it for confirmation emails, but neither a default domain nor a verified custom domain guarantees inbox placement. Sent does not prove that Gmail placed a message in the inbox. A confirmation email in spam can prevent a new contact from completing double opt-in. For your own sending identity, you can open Settings → Domain, configure a sending domain you own, complete the DNS verification instructions, and select a sender profile on that domain as your workspace default. A custom domain is optional. The Webflow form-selection screen displays this guidance even when you already have a custom domain. Submit a test form and complete confirmation to verify the full flow. If a confirmation email lands in spam, inspect its authentication results and contact support with the sending address and message details. Do not assume that changing domains alone fixes deliverability.

Disconnect And Cleanup

When an administrator clicks Disconnect, Sequenzy immediately marks the integration inactive. New webhook requests stop processing. A cleanup job then:

deletes only webhook IDs recorded by Sequenzy and matching this workspace’s callback URL;
lists Webflow app-owned webhooks as a recovery check and deletes only the same matching callback registrations;
revokes the OAuth authorization when no other active Sequenzy workspace uses that grant;
deletes the encrypted token, Webflow user/site/form metadata, capture rules, and local webhook registrations.

Workspace deletion is blocked while a Webflow token or cleanup is still present. Disconnect Webflow and wait for cleanup before deleting the workspace. The Integrations page displays any pending or failed cleanup and provides a Retry cleanup action. Workspace deletion also synchronously removes the workspace’s retained ClickHouse events, attributes, audience rows, and analytics aggregates. If the OAuth grant was removed in Webflow before Sequenzy could delete its webhooks, automatic cleanup may be impossible because the API token no longer works. Reconnect Webflow to the same sites and disconnect again, or remove the Sequenzy app/remaining Sequenzy webhook registrations in Webflow. If either path is unavailable, contact privacy@sequenzy.com with the Sequenzy workspace ID and Webflow site ID for an assisted deletion check.

Verify The Complete Flow

Confirm the integration says capture off immediately after OAuth.
Select one native form and exclude at least one non-required field.
Review double opt-in, configure lists and sequences, then save.
Submit an unselected form. Confirm no Sequenzy contact or event appears.
Submit the selected form with a unique email.
Verify the contact is pending and no marketing sequence runs before email confirmation.
Confirm the email, then verify the subscriber, consent metadata, exact list membership, and webflow.form_submission event. Confirm the excluded field is absent.
Disconnect and confirm webhook cleanup completes; verify the app grant is removed when it is no longer shared.

Permissions

Scope	Use
`authorized_user:read`	Shows the identity that approved the connection.
`forms:read`	Lists native forms and field schemas for explicit selection.
`sites:read`	Lists authorized sites, custom domains, and app-owned webhook registrations; permits deletion of those app-owned webhooks.
`sites:write`	Creates Sequenzy’s form-filtered webhooks.

Get Started

AI Agents

Connect Your App

Send Transactional Email

Audience

Automations and Campaigns

Email Design

Forms and Landing Pages

Analytics

Deliverability

SMS, Push and In-app

Integrations

Ecommerce

Workspace and Billing

Connect And Configure

Form And Field Selection

Data Flow And Storage

Event Shape

Security And Ownership

Custom Domains And Sending Domains

Disconnect And Cleanup

Verify The Complete Flow

Permissions

​Connect And Configure

​Form And Field Selection

​Consent And Enrollment

​Data Flow And Storage

​Event Shape

​Security And Ownership

​Custom Domains And Sending Domains

​Disconnect And Cleanup

​Verify The Complete Flow

​Permissions

​Related Guides

Connect And Configure

Form And Field Selection

Consent And Enrollment

Data Flow And Storage

Event Shape

Security And Ownership

Custom Domains And Sending Domains

Disconnect And Cleanup

Verify The Complete Flow

Permissions

Related Guides