Payload vs Webflow

Payload

Payload generates REST, GraphQL and MCP interfaces from one typed config, with drafts, restorable versions and per-key MCP permissions in the free MIT core. The security record is the limit. The vendor published 49 advisories in 12 months, 8 of them critical, so an install older than 3.90.0 is exposed. No OpenAPI file is published.

Webflow

The Data API has a public OpenAPI 3.1 spec with 140 operations, scoped OAuth and site tokens, and CMS items that stay drafts until a separate publish call. The MCP server loads 34 multi-action tools and can't create new localised CMS items. The free plan holds 50 CMS items, and the activity log needs the $2,500 Team plan.

Payload

1. Check the installed version first. Anything below 3.90.0 carries published critical advisories, so ask the owner to upgrade before writing
2. Send REST keys as Authorization: {collection-slug} API-Key {key} and MCP keys as Authorization: Bearer {key}. The two key kinds are separate
3. To publish, set _status: 'published' in the data. The draft parameter only relaxes validation and chooses where an update is written
4. Upload files with multipart POST to the upload collection, with other fields as JSON in _payload. No MCP upload tool is documented
5. Roll back with POST /api/{collection-slug}/versions/:id after listing versions. Versions exist only where the collection config enables them

Webflow

1. Send the token as Authorization: Bearer to https://api.webflow.com/v2. Ask for cms:read and cms:write only, plus sites:write if the task publishes
2. Create or update items first, then call Publish Items or Publish Site. An item with isDraft true and a lastPublished date is live with unpublished changes
3. Stay under 60 requests a minute on Starter and Basic and 120 on Premium, read X-RateLimit-Remaining, and wait for Retry-After on 429
4. Page item lists with limit (maximum 100) and offset, and filter with filter[<fieldSlug>][<operator>], up to 10 terms
5. Upload an asset in two steps (create the asset with a file hash, then POST the bytes to the presigned URL). Write localised content with the item's cmsLocaleId