# headless-bff-architecture

Design a VTEX BFF for headless storefronts and keep private APIs, credentials, and shopper tokens out of browser code.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1100 installs · ★ 46
- Author: vtex
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/vtex/skills/tree/HEAD/skills/headless-bff-architecture/SKILL.md
- Updated: 2026-10-14
- HTML: https://affpapa.org/en/nevibecode/skills/headless-bff-architecture

## What it does

This skill guides BFF design for headless VTEX storefronts. It helps classify API routes, decide which requests need a server proxy, and keep private calls away from frontend bundles. Intelligent Search is treated as the sole VTEX API that may be called directly by the frontend; public Checkout routes still pass through the BFF because they handle sensitive data.

Shopper authentication uses `VtexIdclientAutCookie` inside a server-side session, never in `localStorage`, `sessionStorage`, or browser JavaScript. Machine-to-machine requests use `X-VTEX-API-AppKey` and `X-VTEX-API-AppToken`, with separate least-privilege keys for BFF modules. `/pvt/` routes must be proxied, and exposing private credentials in client code violates the skill’s security rules.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill headless-bff-architecture -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/headless-bff-architecture/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/headless-bff-architecture/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill headless-bff-architecture -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/headless-bff-architecture/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill headless-bff-architecture -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/headless-bff-architecture/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install vtex/skills headless-bff-architecture
```

2. **Manually: put the files in place**
- File: `.github/skills/headless-bff-architecture/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill headless-bff-architecture -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/vtex/skills --path skills/headless-bff-architecture
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/headless-bff-architecture/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill headless-bff-architecture -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/vtex/skills/tree/HEAD/skills/headless-bff-architecture/SKILL.md

## When to use it
- design a BFF for a headless VTEX storefront
- classify VTEX routes by access level
- move private API calls out of browser code
- store `VtexIdclientAutCookie` in a server session
- split API keys across BFF modules

## Example prompts
- Design a BFF for this headless VTEX storefront and classify every API route.
- Audit the project for browser calls to `/pvt/` endpoints and client-side use of `VtexIdclientAutCookie`.
- Suggest a server session flow and least-privilege API keys for separate BFF modules.

## Similar
- [mcp-builder](https://affpapa.org/en/nevibecode/skills/mcp-builder.md) — skill · 130949 installs
- [claude-api](https://affpapa.org/en/nevibecode/skills/claude-api.md) — skill · 74198 installs
- [lark-im](https://affpapa.org/en/nevibecode/skills/lark-im.md) — skill · 472900 installs
- [lark-event](https://affpapa.org/en/nevibecode/skills/lark-event.md) — skill · 466800 installs
- [caveman-discover](https://affpapa.org/en/nevibecode/skills/caveman-discover.md) — skill · 104400 installs
- [migration](https://affpapa.org/en/nevibecode/skills/migration.md) — skill · 103900 installs

From the same set: [vtex/skills](https://affpapa.org/en/nevibecode/by/vtex/skills.md) — 38 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md