Cotter

Authentication and gated content on a Webflow site depend on a third-party provider. The built-in User Accounts feature was permanently disabled on January 29, 2026. Standard Webflow hosting serves client-side HTML, CSS, and JavaScript, with no server runtime for login logic of your own.

Cotter filled that gap with a passwordless login API and a hosted verification endpoint aimed at sites with no backend. Stytch acquired Cotter on November 18, 2021, then retired the product. The cotter.app homepage redirects to a hostname that no longer has a DNS record, and the developer dashboard that issued API keys answers with a redirect loop, so there is no way to get a key. The documentation archive still loads on GitBook and has not been updated since the acquisition.

Most people reading this page arrived because a login form on a Webflow site stopped working. This page covers what the integration did and how to confirm it is the cause, then which providers do the same job now.

How the Cotter Webflow integration worked, and why it stopped

Cotter was a passwordless authentication API. It sent email magic links and one-time codes over SMS or WhatsApp, and it supported device sign-in built on the WebAuthn standard. It had no Webflow Marketplace app. The integration was pure custom code: a script tag that rendered a login form into a div on the page.

Webflow-hosted sites cannot hold API secrets or run token checks server-side, and Cotter's documentation named Webflow as the case its hosted verification endpoint was built for. Teams added the SDK through custom code in head and body tags, or dropped the form container into a Code Embed element. Those custom code fields need a paid Site plan or a paid Workspace plan, and they only run on a published site.

How to confirm Cotter is what broke your login page

A Cotter form fails quietly rather than throwing an obvious error, so the fastest check is to look for the script and watch the network tab.

1. Open Page settings and Site settings on the affected site and search the custom code fields for cotter.
2. Look for an empty div with the ID cotter-form-container, which is where the SDK used to inject the form.
3. Load the published page with the browser console open. The SDK file itself still downloads from the public CDN, so the failures show up as calls to cotter.app hosts that never resolve.
4. Check any page-protection script for a localStorage token read, since those redirects now send every visitor back to a login page that can never complete.

Removing the script tag and the redirect logic restores the pages to public access. Keep the div and the styling if you plan to drop a replacement form into the same slot.

What the legacy architecture looked like

Cotter split the work across a browser SDK and a set of REST endpoints, and every piece that mattered for security lived on infrastructure Cotter operated.

• The Web SDK: A script tag initialized with your API key ID rendered the email or phone form, then handed back a signed token on success.
• Client-side gating: The token went into localStorage, and a small script on each protected page redirected anyone without one. This hid pages from casual visitors and never protected anything confidential.
• The hosted verification endpoint: A Cotter-run worker validated tokens for sites with no backend, which meant exposing the API key ID in page source.
• Server-side verification: Cotter issued ES256 JWTs that a serverless function could check against a published key set, which was the only version of this pattern that actually secured a resource.

All four depend on hosts that are gone, so nothing in the old Webflow magic link tutorial can be made to work again. The Webflow half of those builds is unaffected: the Webflow API still writes to Webflow CMS collections and still fires webhooks, so only the identity provider has to be swapped.

What you can build with passwordless authentication on Webflow

The builds Cotter was used for are all still possible, on providers that have Webflow integration pages and current documentation. Which one fits depends on whether you need a hosted membership layer or raw auth primitives you wire up yourself.

• Members-only content: Memberstack handles signup and login, then gates pages through attributes you add in Webflow, with no auth code to maintain.
• Paid memberships and billing: Outseta bundles authentication with subscription billing and a CRM, which suits a site where access follows a paid plan.
• Magic links and social login: Auth0 covers the closest equivalent to what Cotter offered, including passwordless email login and enterprise identity providers.
• Auth plus a database: Supabase gives you passwordless sign-in and a Postgres database behind it, which is the option to reach for when member records need to live somewhere queryable.

Every one of these still needs server-side token verification to protect anything real, which is the lesson the Cotter pattern taught the hard way. See how the pieces fit together in our guide to building a full-stack app on Webflow Cloud.

If you are auditing several sites for leftover Cotter code, connect the Webflow MCP server to your AI tool and have it search page and site custom code across your workspace rather than clicking through settings panels one site at a time.