skills.rest
exilonX
exilonXCOMMUNITY
Explore all skills by this author →
GitHub

vtex-io-auth-tokens-and-context

Select the correct VTEX IO authentication token based on requester context.

Updated Mar 27, 2026
Search Tags:#backend integration#admin#storefront#request context#vtex-io#auth tokens#security guardrails
One-click install
npx skills add https://github.com/exilonX/ap2 --skill vtex-io-auth-tokens-and-context-exilonx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vtex-io-auth-tokens-and-context
Source: https://github.com/exilonX/ap2/tree/main/.agents/skills/vtex-io-auth-tokens-and-context
Command: npx skills add https://github.com/exilonX/ap2 --skill vtex-io-auth-tokens-and-context-exilonx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill prevents accidental authorization mismatches by helping you choose the correct VTEX IO authentication token for the requester behind a backend call (shopper, Admin user, or app context).

Core Features & Use Cases

  • Token selection by requester context: Choose between ctx.authToken, ctx.storeUserAuthToken, and ctx.adminUserAuthToken based on whether the request is app-scoped, storefront/shopper-driven, or Admin-driven.
  • Identity-aware client wiring: Ensure VTEX clients and custom wrappers propagate the matching auth token (or explicitly set authMethod) instead of defaulting silently.
  • Guardrails against credential misuse: Avoid logging or returning raw tokens, avoid hardcoding appKey/appToken, and keep Admin tokens server-side only.

Use case example: An Admin dashboard action that lists orders must respect the logged-in Admin user's License Manager role, so the integration should use ADMIN_TOKEN with ctx.adminUserAuthToken rather than defaulting to ctx.authToken.

Quick Start

Apply the vtex-io-auth-tokens-and-context skill to decide whether a given VTEX IO request should use STORE_TOKEN, ADMIN_TOKEN, or AUTH_TOKEN based on the current request path and IOContext fields.

Frequently Asked Questions about vtex-io-auth-tokens-and-context

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I select the correct VTEX IO authentication token for storefront or Admin requests?▼

Select VTEX IO authentication tokens by checking the requester context: use ctx.storeUserAuthToken for storefront shoppers, ctx.adminUserAuthToken for Admin users, and ctx.authToken only for app-scoped background operations.

When should I use ctx.authToken instead of ctx.adminUserAuthToken in VTEX IO?▼

Use ctx.authToken only for truly app-scoped background operations where the call represents the app itself rather than a specific user. Use ctx.adminUserAuthToken when an Admin user's identity and License Manager role must be enforced.

What's the best way to prevent token leakage in VTEX IO backend integrations?▼

Prevent token leakage by keeping Admin tokens server-side only, avoiding logging or returning raw tokens, and never hardcoding appKey or appToken values directly within your VTEX IO integration code.

Why does my VTEX IO Admin dashboard action ignore the logged-in user's License Manager role?▼

Admin dashboard actions ignore License Manager roles when defaulting to ctx.authToken instead of using ctx.adminUserAuthToken. You must propagate ADMIN_TOKEN to enforce the logged-in Admin user's permissions.

How do I ensure VTEX clients propagate the correct auth token instead of defaulting silently?▼

Ensure identity-aware client wiring by explicitly passing the matching auth token or setting the authMethod property on VTEX clients and custom wrappers, preventing silent defaults that cause authorization mismatches.

Can I use storefront tokens for app-level background operations in VTEX IO?▼

No, storefront tokens like ctx.storeUserAuthToken are tied to shopper identity. App-level background operations require ctx.authToken to authenticate as the app itself rather than a specific storefront user.

Related Skills

Explore More Software Engineering Skills→
vtexvtex
39

vtex-io-auth-tokens-and-context

Select and propagate VTEX IO authentication tokens for backend requests.

Official
Advanced
vtexdocsvtexdocs
39

headless-bff-architecture

Route private VTEX API calls through a secure Express-based BFF.

Official
Advanced
vtexvtex
39

vtex-io-app-settings

Define, validate, and consume VTEX IO app settings with settingsSchema and getAppSettings.

Official
Advanced
CENKSSSCENKSSS

n8n-security-testing

Scan n8n workflows for credential exposure, webhook security, and data leakage.

Community
Advanced