# headless-checkout-proxy

Guides agents when building cart and checkout flows for headless VTEX via a BFF. Ensures safe OrderForm proxying and strict PCI DSS compliance.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1100 installs · ★ 46
- Author: vtex
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/vtex/skills/tree/HEAD/skills/headless-checkout-proxy/SKILL.md
- Updated: 2026-10-14
- HTML: https://affpapa.org/en/nevibecode/skills/headless-checkout-proxy

## What it does

This skill enforces architectural boundaries for headless VTEX storefronts. Every interaction with the Checkout API (`/api/checkout/...`) must pass through the backend-for-frontend layer. Saving `orderFormId` or session cookies inside `localStorage` is forbidden; they must stay inside server-side storage to protect customer profile and address data.

For checkout completion, the rule enforces a three-stage sequence: place order, submit payment, and process transaction. Credit card payloads must bypass the BFF entirely. Browsers send sensitive card fields directly to `vtexpayments.com.br`, keeping the merchant server outside the scope of strict PCI DSS audits.

Values like `orderGroup` must travel between flow steps via request bodies rather than `req.session`. When running multiple BFF replicas, pod restarts or routing mismatches drop in-memory session data, triggering unwanted 400 errors.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill headless-checkout-proxy -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/headless-checkout-proxy/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/headless-checkout-proxy/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill headless-checkout-proxy -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/headless-checkout-proxy/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill headless-checkout-proxy -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/headless-checkout-proxy/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install vtex/skills headless-checkout-proxy
```

2. **Manually: put the files in place**
- File: `.github/skills/headless-checkout-proxy/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill headless-checkout-proxy -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/vtex/skills --path skills/headless-checkout-proxy
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/headless-checkout-proxy/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill headless-checkout-proxy -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/vtex/skills/tree/HEAD/skills/headless-checkout-proxy/SKILL.md

## When to use it
- proxy VTEX Checkout API calls safely through a backend layer
- keep orderFormId and session cookies out of browser storage
- route raw credit card data straight to vtexpayments.com.br
- pass orderGroup across checkout steps in multi-replica deployments

## Example prompts
- Write a BFF endpoint to attach shipping data to the current VTEX OrderForm
- Implement the 3-step checkout flow with direct card submission to VTEX payments
- Show how to manage OrderForm ownership cookies on the server

## Similar
- [mcp-builder](https://affpapa.org/en/nevibecode/skills/mcp-builder.md) — skill · 130949 installs
- [claude-api](https://affpapa.org/en/nevibecode/skills/claude-api.md) — skill · 74198 installs
- [lark-im](https://affpapa.org/en/nevibecode/skills/lark-im.md) — skill · 472900 installs
- [lark-event](https://affpapa.org/en/nevibecode/skills/lark-event.md) — skill · 466800 installs
- [caveman-discover](https://affpapa.org/en/nevibecode/skills/caveman-discover.md) — skill · 104400 installs
- [migration](https://affpapa.org/en/nevibecode/skills/migration.md) — skill · 103900 installs

From the same set: [vtex/skills](https://affpapa.org/en/nevibecode/by/vtex/skills.md) — 38 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md