OAuth apps no longer need trusted-platform access

The trusted-platform gate is gone. A third-party OAuth application that a customer connected, consented to and granted a workspace to can now use the whole write surface it was previously refused: page markup and head/footer code, funnel creation and conditional split steps, workflows, blog post writes, email templates and broadcasts (including sending), order line-item change-variant, and Refine filters. There is nothing to apply for, and no per-workspace switch to ask support to flip — that flag never lived on a customer workspace in the first place, which is why those requests could not be granted as written.

403 is still a real response on all of these endpoints, so keep handling it — it just means something different now. It comes from the access token's own scopes (This access token's scopes do not grant write access to Emails. Granted scopes: emails:read.), or from using an MCP-scoped token against the REST API. If you get a 403 on a write, read the message: it tells you which scope you are missing rather than pointing you at an application form.

The consent screen also names what it actually grants. A workspace-scoped grant now reads "Full read & write access to your ClickFunnels workspace Acme" instead of claiming access to the whole account. Account-wide wording is kept only for grants that really are account-wide.

Agent examples: publish a funnel a customer designed in your own product, with real page markup, on the first connection instead of leaving every page blank · send a broadcast on a connected workspace without a support ticket in front of it.

Resources: Page
Building with an AI agent? Point it at the Pages skill.