Salesforce Authenticator

Webflow stopped offering native account-based login for site visitors when User Accounts shut down on January 29, 2026. Page password protection still covers a private page with one shared password, and Webflow account two-factor authentication still covers the people who build and publish the site. Neither of those is the login a lead actually travels through. That one sits in your CRM, behind an admin console your marketing site quietly depends on.

Salesforce Authenticator is the mobile app standing in front of that console. It reaches a Webflow team in two places. It can be the second factor on your own Webflow account, because it generates standard TOTP codes for non-Salesforce services, and it is the prompt an admin answers when signing in to Salesforce to configure or repair the pipeline carrying Webflow form submissions into Salesforce CRM.

It is not something you add to a Webflow page. No embed, no script tag, and no supported way to make a site visitor authenticate with it from your site. Marketing ops teams feeding leads into Salesforce, and the admins holding the keys to that org, are who this page is for.

How to integrate Salesforce Authenticator with Webflow

What is Salesforce Authenticator? Salesforce Authenticator is Salesforce's mobile multi-factor authentication app for iOS and Android. It approves Salesforce logins through push notifications, and for every other service it generates six-digit time-based one-time passwords, which is what makes it usable with Webflow at all. Salesforce's own documentation for the app puts it plainly: you can use it with any service that supports MFA with TOTPs.

Teams pair the two when a Webflow marketing site feeds Salesforce and the humans on both sides need a second factor. Salesforce has required MFA contractually since 2022, and its security roadmap schedules technical enforcement for all employee users on production orgs from July 20, 2026, staggered by release group. The same roadmap puts phishing-resistant MFA for privileged users, admins included, on that same date, so confirm which verification methods your org will accept before you standardize on one. Any admin who signs in to build a Webflow form sync meets whichever requirement lands first.

Three surfaces carry the combination. Setting up Salesforce Authenticator as the TOTP app for Webflow 2FA needs no code and protects the people who publish your site. Linking Webflow pages to a Salesforce-hosted login hands the whole authentication step, MFA included, to Salesforce. Building with the Webflow and Salesforce APIs gives you control over gated content and form-to-CRM sync, and it needs server-side work.

Use Salesforce Authenticator as the TOTP app for Webflow 2FA

This is the only place Salesforce Authenticator touches Webflow directly. Webflow account two-factor authentication accepts any app producing a timed six-digit code, and Salesforce Authenticator produces one for every non-Salesforce account you add to it, so a Salesforce admin can carry one app instead of two. Push notifications and trusted-location approval stay available for Salesforce accounts. The Webflow entry is codes only, and each code expires after 30 seconds.

To set up Webflow 2FA with Salesforce Authenticator:

1. Open your Webflow account settings, go to the Security tab, and start the two-factor authentication setup.
2. In Salesforce Authenticator, add Webflow as a non-Salesforce account by scanning the QR code Webflow shows.
3. Enter the six-digit code the app displays to confirm the pairing, then save the backup codes Webflow gives you.

Two limits are worth knowing before you rely on this. Automated approval never applies to the Webflow entry: Salesforce automates a request only after you approve the same five factors three times, those factors being service, username, action, location, and client, and the feature works only when a Salesforce ecosystem account is connected and your admin has enabled it. Backup carries the same condition, and Salesforce states it exactly: "The backup feature can be enabled only if you have at least one Salesforce ecosystem account connected to the app." Keep one connected, or your Webflow entry will not survive a new phone. The backup instructions cover the email-based flow used from app version 4.0 onward.

Link Webflow pages to a Salesforce-hosted login

A button on a Webflow page can point straight at a Salesforce Experience Cloud login URL, which is the only no-code route that puts a visitor in front of a Salesforce login at all. Salesforce owns the username, password, and any MFA challenge on its own pages, then redirects the user onward. You can brand that page in Experience Builder, and SAML single sign-on is available for Experience Cloud sites on Enterprise, Performance, Unlimited, and Developer editions.

To add the login link:

1. In Salesforce Setup, configure and publish the Experience Cloud site login page.
2. In Webflow, add a Button element to the page and paste the Experience Cloud login URL into its link settings.
3. Publish the site and test the round trip from a logged-out browser.

Be careful about who actually sees the Authenticator prompt here. For orgs created in Spring '24 or later, Salesforce Authenticator is off by default for external users, and switching it on means contacting Salesforce Customer Support. Internal users signing in to the same site get the prompt as normal. A partner or customer arriving from your Webflow site will usually be verified by something else, so do not promise them push approval. If your team reaches Salesforce through a corporate identity provider instead, enabling Salesforce MFA for SSO keeps the Authenticator prompt in the flow.

Build with the Webflow and Salesforce APIs

Gated-content and form-sync builds need server-side code, and Salesforce Authenticator's role inside them is fixed: it is the human MFA prompt on the Salesforce login page reached through GET /services/oauth2/authorize. Your code never talks to the app. Around that fixed point, the two APIs let you gate Webflow content behind a Salesforce login and push form submissions into Sales Cloud with no MFA interruption at all. Webflow Cloud runs Next.js or Astro apps on Cloudflare Workers and is the natural host.

Four references carry most of the work:

• Salesforce OAuth and client apps: the authorization guide covers the authorize and token endpoints, and notes that creating connected apps is restricted as of Spring '26 while existing ones keep working.
• Salesforce REST API: the resource reference lists the sObject routes you need for Lead creation, upserts, and SOQL queries.
• Webflow Data API: the REST introduction covers Webflow CMS collection items and form submissions.
• Webflow webhooks: webhook registration needs a token with the sites:write scope and pushes real-time events between the two systems.

The two builds below use all four, and differ mainly in whether a human is present.

Gate Webflow content behind Salesforce login with MFA

Webflow CMS pages publish as static HTML, so real access control has to happen server-side. A Webflow Cloud route handler runs the OAuth 2.0 authorization code flow against Salesforce, validates the returned token, and only then serves protected data. The visitor sees the standard Salesforce login page, and an internal user configured with Salesforce Authenticator gets a push notification when MFA is required. This build suits internal-user portals such as sales enablement libraries or partner dashboards.

To implement the gate:

1. In Salesforce Setup, create an External Client App with the OAuth 2.0 Authorization Code flow enabled. Set the callback URI to your Webflow Cloud app, for example https://your-cloud-app.webflow.io/auth/callback, and note the Consumer Key and Consumer Secret.
2. Redirect unauthenticated visitors to Salesforce. The openid scope adds a signed ID token per the scope reference:

GET https://MY_DOMAIN_NAME/services/oauth2/authorize
  ?response_type=code
  &client_id={CONSUMER_KEY}
  &redirect_uri={YOUR_CALLBACK_URL}
  &scope=openid api

3. Exchange the code for tokens. The response includes an access_token, plus the id and id_token fields:

POST https://MY_DOMAIN_NAME/services/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code={SALESFORCE_OAUTH_CODE}
&client_id={CONSUMER_KEY}
&client_secret={CONSUMER_SECRET}
&redirect_uri={YOUR_CALLBACK_URL}

4. Call the Identity URL in the id field, formatted https://login.salesforce.com/id/{orgId}/{userId}, with Authorization: Bearer {access_token} to read the user's claims.
5. Validate the token in the route handler before returning protected data. Use fetch for outbound calls, because Webflow Cloud's Edge runtime guidance warns that third-party clients such as axios may not be compatible.
6. On logout, revoke the token:

POST https://{MyDomainName}.my.salesforce.com/services/oauth2/revoke
Content-Type: application/x-www-form-urlencoded

token={CURRENT_TOKEN}

Sync Webflow form submissions to Salesforce without an MFA prompt

No human is present in this path, so no MFA prompt fires. Each incoming Webflow form_submission webhook passes signature verification, then a serverless function writes a Lead through the Salesforce REST API using the client credentials flow. Salesforce's guidance on integration users sets the conditions for that flow, among them that the integration has "no end-user interaction during the authentication process," and recommends a dedicated integration user on the Minimum Access API Only Integrations profile. The admin still completes an Authenticator prompt once, when logging in interactively to create the external client app.

To build the sync:

1. Register the webhook:

POST https://api.webflow.com/v2/sites/{site_id}/webhooks
Authorization: Bearer {WEBFLOW_TOKEN}
Content-Type: application/json

{
  "triggerType": "form_submission",
  "url": "https://your-cloud-app.webflow.io/webhooks/sf-sync"
}

2. Verify each incoming request per the webhook signature guide. Read x-webflow-timestamp, concatenate timestamp + ":" + JSON.stringify(request_body), compute an HMAC SHA-256 with the signing key, and compare it to x-webflow-signature with a timing-safe comparison. Reject timestamps older than 5 minutes.
3. Parse the form_submission payload. Field values sit in data, and the payload also carries name, siteId, formId, submittedAt, and localeId.
4. Get a Salesforce access token without a browser:

POST https://MY_DOMAIN_NAME/services/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id={CONSUMER_KEY}
&client_secret={CONSUMER_SECRET}

5. Create the Lead with the sObject endpoint, or upsert by external ID to avoid duplicates with PATCH /services/data/{version}/sobjects/Lead/{externalIdField}/{value}:

POST https://{instance_url}/services/data/{version}/sobjects/Lead
Authorization: Bearer {access_token}
Content-Type: application/json

{"LastName": "...", "Email": "...", "Company": "..."}

6. Return HTTP 200. On any other status, Webflow retries up to 3 more times at 10-minute intervals, then deactivates the webhook and emails you.

For site-token webhooks created after April 14, 2025, each webhook carries its own secret key. For OAuth app webhooks, the signing key is the app's client secret.

What you can build with the Salesforce Authenticator Webflow integration

Webflow keeps public CMS pages static while Salesforce handles authentication for protected routes and Experience Cloud destinations, which is what makes each of these builds practical.

• Partner portal entry point on Experience Cloud: A B2B marketing site on Webflow carries a partner login button that opens a branded Experience Cloud login page, and internal account managers approve the push notification in Salesforce Authenticator while the public pages stay static.
• Gated sales enablement library on Webflow Cloud: A Webflow Cloud route wraps a CMS collection of pricing sheets and battlecards in the Salesforce OAuth flow above, so reps authenticate once with their Salesforce credentials plus an Authenticator approval, then browse.
• Lead capture that survives MFA enforcement: A demo request form posts through a form_submission webhook to a function that upserts Leads with the client credentials flow, so enforcement never stalls a lead. Samsara's Webflow site is built on the same premise, and its growth team says leads are created in Salesforce in seconds and routed automatically. The Form Connector app, published by the agency Candid Leap rather than by Salesforce, covers the same route without code.
• A read-only CMS mirror of Salesforce records: A scheduled job reads records through the Salesforce REST API with the same client credentials token and writes them to a collection with POST /v2/collections/{collection_id}/items/live, so an unattended sync never meets an MFA prompt at all.

The API path is the one that gives you control over token validation, session length, and per-page authorization rules. See role-based access in Webflow for a worked build of the gated-portal pattern.