netlify-access-control

Routes Netlify access-control requests to Identity, Password Protection, Auth0, or SAML SSO.

Updated Jul 16, 2026
One-click install
npx skills add https://github.com/JamesMitofsky/tag-archive --skill netlify-access-control-jamesmitofsky
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: netlify-access-control
Source: https://github.com/JamesMitofsky/tag-archive/tree/main/.claude/skills/netlify-access-control
Command: npx skills add https://github.com/JamesMitofsky/tag-archive --skill netlify-access-control-jamesmitofsky

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Netlify offers three independent access-control layers — Netlify Identity, Password Protection, and Team/Org SAML SSO — that are easy to conflate, and picking the wrong one (or stacking two when one would do) causes double logins, hidden seat costs, and wasted setup effort. ## Core Features & Use Cases - Layer disambiguation: Explains the difference between app-level Identity (nf_jwt), site-visitor Password Protection, and dashboard-level SAML SSO, including why "sign in with Google" can mean two unrelated things. - Decision routing: Walks through a decision tree to pick invite-only Identity, the Auth0 extension, Basic Password Protection, or the Enterprise two-layer pattern based on team size, plan, and SSO needs. - Tradeoff warnings: Names the double-login reality of stacking a perimeter gate with Identity, the paid-seat cost of team login, and the dashboard-only configuration constraint agents cannot probe. - Use Case: A user asks to make their Netlify site "employees only." The skill routes them to invite-only Netlify Identity for a small team, or the Auth0 extension federating to their corporate IdP for a whole company — avoiding the double-login stack. ## Quick Start Ask how to restrict access to your Netlify site to only your company's employees and get a recommendation for the right access-control layer.

Frequently Asked Questions about netlify-access-control

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I restrict my Netlify site to employees only?

For a small team, enable Netlify Identity in invite-only mode and invite only company addresses — one login with full per-user identity on any plan. For a whole company with an existing IdP, use the Netlify Auth0 extension federating to Okta, Entra, or Google Workspace.

What is the difference between Netlify Identity and Password Protection?

Netlify Identity handles app-level user accounts and issues the nf_jwt cookie for your end users. Password Protection gates whether a request can load the site at all, using a shared password (Pro+) or team login (Enterprise), and is configured only in the dashboard.

Netlify Identity vs SAML SSO — which do I need?

Identity authenticates your app's end users; Team/Org SAML SSO authenticates Netlify team members logging into the dashboard via a corporate IdP. They are independent layers with separate sessions, so choose based on whether you need in-app user accounts or dashboard access control.

Can I combine Password Protection with Netlify Identity without double login?

No. When both are active, users authenticate twice — once at the perimeter and once in the app — with no documented passthrough, shared cookie, or JWT exchange between the sessions. If single sign-on matters, use invite-only Identity or the Auth0 extension instead.

Can I configure Netlify access control via API or CLI?

No. Password Protection, SAML SSO, and the Auth0 extension are configured only in the Netlify dashboard — there is no public API, CLI command, or MCP tool to set or read them. The one runtime exception is getSettings() from @netlify/identity for reading live Identity providers.