Hygraph vs Webflow

Hygraph

Tokens are limited by model, stage, locale and action, the GraphQL schema is typed and introspectable, and a hosted MCP server rejects delete and unpublish operations. Error bodies carry a message without a machine code, there are no idempotency keys, audit logs are Enterprise only, and no data processing agreement, sub-processor list or security.txt was found.

Webflow

The Data API has a public OpenAPI 3.1 spec with 140 operations, scoped OAuth and site tokens, and CMS items that stay drafts until a separate publish call. The MCP server loads 34 multi-action tools and can't create new localised CMS items. The free plan holds 50 CMS items, and the activity log needs the $2,500 Team plan.

Hygraph

1. Send the Permanent Auth Token as Authorization: Bearer <token> to https://<region>.hygraph.com/v2/<projectId>/<environment>. Read the schema by introspection first, because every type is generated from the project's models
2. Mutations write to DRAFT. Call publish<Model> with to: [PUBLISHED] as a separate mutation, and pass locales to write or publish a localisation
3. Stay under the plan's limit for uncached requests (5 a second on Hobby, 25 on Growth) and its concurrent mutations (5 and 10). Back off exponentially on 429
4. Upload an asset with createAsset, then POST the file to the returned pre-signed URL, or pass uploadUrl for a remote file. The asset stays ASSET_CREATE_PENDING until processed
5. Schema changes go to the Management API through @hygraph/management-sdk or the MCP tool submit_batch_migration. Version restore has no documented mutation, so read <model>Version and write the old values back

Webflow

1. Send the token as Authorization: Bearer to https://api.webflow.com/v2. Ask for cms:read and cms:write only, plus sites:write if the task publishes
2. Create or update items first, then call Publish Items or Publish Site. An item with isDraft true and a lastPublished date is live with unpublished changes
3. Stay under 60 requests a minute on Starter and Basic and 120 on Premium, read X-RateLimit-Remaining, and wait for Retry-After on 429
4. Page item lists with limit (maximum 100) and offset, and filter with filter[<fieldSlug>][<operator>], up to 10 terms
5. Upload an asset in two steps (create the asset with a file hash, then POST the bytes to the presigned URL). Write localised content with the item's cmsLocaleId