# vtex-io-auth-tokens-and-context

Decides which VTEX IO token should back a backend request: the app itself, a shopper, or an Admin user.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1100 installs · ★ 46
- Author: vtex
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/vtex/skills/tree/HEAD/skills/vtex-io-auth-tokens-and-context/SKILL.md
- Updated: 2026-10-14
- HTML: https://affpapa.org/en/nevibecode/skills/vtex-io-auth-tokens-and-context

## What it does

The skill applies when the open question is which identity authenticates a call to VTEX services. It covers three options: `ctx.authToken` for app-level work, `ctx.storeUserAuthToken` for storefront and shopper-triggered flows, and `ctx.adminUserAuthToken` for Admin requests that must respect the logged-in user's License Manager role.

Inside are decision rules, a token-to-context table, and hard constraints with TypeScript examples. If a shopper or Admin user started the request, the skill pushes for the user token instead of the app token. Clients that accept `authMethod` get the token choice passed explicitly. When you wrap a custom VTEX client, the matching token travels from `IOContext` at the client boundary rather than being hardcoded in handlers.

\`ADMIN_TOKEN` with `ctx.adminUserAuthToken` stays server-side: never expose it or proxy it to a browser client. Raw tokens should not be logged or returned in responses either. Policy design in `manifest.json`, route-level authorization, and the choice between `ExternalClient` and `JanusClient` sit outside this skill.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-auth-tokens-and-context -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/vtex-io-auth-tokens-and-context/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/vtex-io-auth-tokens-and-context/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-auth-tokens-and-context -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/vtex-io-auth-tokens-and-context/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-auth-tokens-and-context -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/vtex-io-auth-tokens-and-context/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install vtex/skills vtex-io-auth-tokens-and-context
```

2. **Manually: put the files in place**
- File: `.github/skills/vtex-io-auth-tokens-and-context/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-auth-tokens-and-context -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/vtex/skills --path skills/vtex-io-auth-tokens-and-context
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/vtex-io-auth-tokens-and-context/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add vtex/skills --skill vtex-io-auth-tokens-and-context -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/vtex/skills/tree/HEAD/skills/vtex-io-auth-tokens-and-context/SKILL.md

## When to use it
- pick a token for a storefront request without escalating to app permissions
- decide which identity an Admin-triggered VTEX client call should use
- strip hardcoded `appKey` and `appToken` from a VTEX IO app
- check whether an Admin token leaks into a browser client
- propagate the right token from `IOContext` when wrapping a client

## Example prompts
- Which token goes in the client header for a request that came from the storefront?
- Review my `OmsClient`: should this be `ctx.storeUserAuthToken` or `ctx.authToken`?
- Replace the hardcoded `appKey` and `appToken` with the token from `IOContext`

## Similar
- [api-auth-key-management](https://affpapa.org/en/nevibecode/skills/api-auth-key-management.md) — skill · 7800 installs
- [adding-auth](https://affpapa.org/en/nevibecode/skills/adding-auth.md) — skill · 379 installs
- [better-auth-security-best-practices](https://affpapa.org/en/nevibecode/skills/better-auth-security-best-practices.md) — skill · 48000 installs
- [better-auth-core](https://affpapa.org/en/nevibecode/skills/better-auth-core.md) — skill · 358 installs
- [omni-auth](https://affpapa.org/en/nevibecode/skills/omni-auth.md) — skill · 1100 installs
- [jwt-decode](https://affpapa.org/en/nevibecode/skills/jwt-decode.md) — skill · 708 installs

From the same set: [vtex/skills](https://affpapa.org/en/nevibecode/by/vtex/skills.md) — 8 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md