# vtex-io-auth-and-policies

This skill guides VTEX IO permission design for integrations, protected routes, and manifest policies. Use it when access boundaries need review or change.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1100 installs · ★ 46
- Author: vtex
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/vtex/skills/tree/HEAD/skills/vtex-io-auth-and-policies/SKILL.md
- Updated: 2026-10-14
- HTML: https://affpapa.org/en/nevibecode/skills/vtex-io-auth-and-policies

## What it does

The skill helps map VTEX IO app capabilities to explicit authorization rules. It covers access to VTEX resources, services exposed by other apps, and external HTTP endpoints. It also separates consumer permissions from server-side protection for routes owned by the app.

Its main focus is `manifest.json`, including License Manager entries, app policies, and `outbound-access`. External rules should name the required host and path, while protected routes can use resource-based policies. VRNs belong where the platform expects resource or principal identifiers, such as `service.json` policies.

A missing required policy causes the platform to block the request even when the handler code is correct. Review the permission boundary whenever a new client, external host, integration, or protected route appears, and narrow wildcard access where the integration uses a smaller surface.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-auth-and-policies -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/vtex-io-auth-and-policies/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/vtex-io-auth-and-policies/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-auth-and-policies -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/vtex-io-auth-and-policies/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-auth-and-policies -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/vtex-io-auth-and-policies/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install vtex/skills vtex-io-auth-and-policies
```

2. **Manually: put the files in place**
- File: `.github/skills/vtex-io-auth-and-policies/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-auth-and-policies -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/vtex/skills --path skills/vtex-io-auth-and-policies
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/vtex-io-auth-and-policies/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-auth-and-policies -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/vtex/skills/tree/HEAD/skills/vtex-io-auth-and-policies/SKILL.md

## When to use it
- audit VTEX IO app permissions
- declare access for an external API
- map a route to an authorization policy
- narrow an `outbound-access` rule
- spot missing entries in `manifest.json`

## Example prompts
- Review this VTEX IO app and list the permissions missing from `manifest.json`.
- Add access for the external API and keep its `outbound-access` host and path narrow.
- Check which callers may reach this protected route and align it with a resource-based policy.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [vtex/skills](https://affpapa.org/en/nevibecode/by/vtex/skills.md) — 38 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md