Skip to main content
affpapa.org
RU EN
skill CX Codex

vtex-io-auth-tokens-and-context — Claude Code skill for VTEX IO tokens

Decides which VTEX IO token should back a backend request: the app itself, a shopper, or an Admin user.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add vtex/skills --skill vtex-io-auth-tokens-and-context -a claude-code
Open on GitHub

What vtex-io-auth-tokens-and-context does

The skill applies when the open question is which identity authenticates a call to VTEX services. It covers three options: ctx.authToken for app-level work, ctx.storeUserAuthToken for storefront and shopper-triggered flows, and ctx.adminUserAuthToken for Admin requests that must respect the logged-in user's License Manager role.

Inside are decision rules, a token-to-context table, and hard constraints with TypeScript examples. If a shopper or Admin user started the request, the skill pushes for the user token instead of the app token. Clients that accept authMethod get the token choice passed explicitly. When you wrap a custom VTEX client, the matching token travels from IOContext at the client boundary rather than being hardcoded in handlers.

ADMIN_TOKEN with ctx.adminUserAuthToken stays server-side: never expose it or proxy it to a browser client. Raw tokens should not be logged or returned in responses either. Policy design in manifest.json, route-level authorization, and the choice between ExternalClient and JanusClient sit outside this skill.

What it helps with

  • pick a token for a storefront request without escalating to app permissions
  • decide which identity an Admin-triggered VTEX client call should use
  • strip hardcoded appKey and appToken from a VTEX IO app
  • check whether an Admin token leaks into a browser client
  • propagate the right token from IOContext when wrapping a client

Example prompts for the agent

  • Which token goes in the client header for a request that came from the storefront?
  • Review my OmsClient: should this be ctx.storeUserAuthToken or ctx.authToken?
  • Replace the hardcoded appKey and appToken with the token from IOContext

How to install vtex-io-auth-tokens-and-context

1Skills CLI (Vercel)

npx skills add vtex/skills --skill vtex-io-auth-tokens-and-context -a claude-code

2Manually: put the files in place

~/.claude/skills/vtex-io-auth-tokens-and-context/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/vtex-io-auth-tokens-and-context/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about vtex-io-auth-tokens-and-context

How do I install vtex-io-auth-tokens-and-context in Claude?

Run npx skills add vtex/skills --skill vtex-io-auth-tokens-and-context -a claude-code. The skill file then lands at ~/.claude/skills/vtex-io-auth-tokens-and-context/SKILL.md.

What does vtex-io-auth-tokens-and-context do?

It helps you choose between ctx.authToken, ctx.storeUserAuthToken, and ctx.adminUserAuthToken for a request from a VTEX IO backend app. It also covers authMethod and passing the token at the client boundary.

What is out of scope for this skill?

Policies in manifest.json, route-level authorization, and picking between ExternalClient and JanusClient. Those belong to other skills.

Similar skills

Everything for Backend and APIs →
api-auth-key-management Samuel Berthe Design provider-side API key architecture with checksum prefixes, hashed storage, and zero-downtime rotation. Helpful when managing machine credentials and audit compliance. CX Codex +1 7,800installs adding-auth spencerpauly A skill that walks the agent through adding authentication to a web app with NextAuth.js: OAuth providers, sessions and protected routes. CX Codex +1 379installs better-auth-security-best-practices better-auth Hardens Better Auth deployments by configuring rate limits, CSRF rules, session caching, and OAuth token encryption. CX Codex +1 48,000installs better-auth-core bobmatnyc A skill for wiring Better Auth into TypeScript apps: the instance, server handlers, client, and sessions. Useful when you need auth running without digging through docs. CX Codex +1 358installs omni-auth cheaper-inference A skill for handling Anthropic auth: Bearer tokens for the API, session cookies for the dashboard. Useful when your agent hits gateway endpoints. CX Codex +1 1,100installs jwt-decode jsonwebtoken Splits a JWT into header, payload and signature, prints every claim and flags the expiry. Handy when you just need to see what is inside a token. CX Codex +1 708installs

From the same set8

vtex-io-masterdata Walks you through Master Data v2 in VTEX IO apps and pushes back when the data belongs somewhere else. CX Codex +1 1,200installs payment-idempotency A skill for payment connector code that keeps Gateway retries from hitting the acquirer twice and charging the customer again. CX Codex +1 1,100installs vtex-io-service-paths-and-cdn Picks the right path prefix in service.json and matches Cache-Control to the data, so edge caching does not serve one shopper's payload to another. CX Codex +1 1,100installs vtex-io-http-routes Guides the design of HTTP endpoints in a VTEX IO backend service: route boundaries, middleware chains, request validation and response shape. CX Codex +1 1,100installs marketplace-rate-limiting Teaches your agent to handle VTEX API 429s: exponential backoff with jitter, rate limit headers, circuit breaker and request queuing. CX Codex +1 1,000installs payment-async-flow Rules for VTEX payment connector code: Boleto, Pix, bank redirects, callbackUrl handling and signature validation. CX Codex +1 1,000installs vtex-io-rbac Walks you through locking down VTEX IO app routes and resources: role policies, resource policies, VRN principals and @auth directives. CX Codex +1 737installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor