/netlify-access-control

name: netlify-access-control
description: Picks the right Netlify protection layer for a deployed site and disambiguates the three unrelated things people call "auth". Use when a developer wants to password-protect a site or previews, restrict a project to their team, make a project public/private, set team visibility defaults, require SSO to view a site, or debug SSO-session symptoms like being logged out mid-session / getting 401s on an SSO-protected site / token expiry or refresh. Routes app-user login ("who is this user in my app") to the netlify-identity skill and dashboard/team SSO SSO elsewhere; this skill only chooses the perimeter layer for site/preview access.

Netlify access control (picking the protection layer)

This skill ROUTES. Its job is choosing the correct protection layer for loading a site, not implementing app auth. Before recommending anything, disambiguate — three unrelated layers get called "auth":

• **Netlify Identity** — "who is this user *inside* my app" (issues `nf_jwt`). App login, OAuth providers for your users, auth code. → Route to the **netlify-identity** skill. Not covered here.
• **Password Protection / Project visibility** — "can this request load the site at all." Platform perimeter. **This skill.**
• **Team/Org SAML SSO** — "can you log into the Netlify dashboard." Team member access to Netlify itself.

Sessions are separate. The same provider (e.g. Google) can be an Identity OAuth provider for app users AND a SAML IdP for team members — unrelated wiring.

Footgun: no API, CLI, or MCP for these settings

These settings have **no public API, no CLI command, and no MCP tool**. Do NOT curl `api.netlify.com` or read local auth tokens to inspect or change them. Hand the user the dashboard path and checklist. On failure, report what you tried and stop.

Footgun: the double login is real

A Password-Protection / team-login perimeter session and a Netlify Identity app session have **no bridge** — no shared cookie, no header forwarding, no JWT exchange. Don't burn iterations trying to wire them together. For the combined Password-Protection + Identity pattern and its tradeoffs, see `references/two-layer-pattern.md`.

For company-wide app-level SSO with a single sign-in (no double login), recommend the **Auth0 extension** (federating to the corporate IdP) BEFORE the two-layer stack.

Pick the layer

| Goal | Use | |---|---| | Restrict site to your team, invite by email | Private project (Credit-based) or team login protection | | Shared password anyone can use | Basic password protection, or Password visibility (Pro only) | | Protect only previews, keep production open | "Non-production deploys only" / "Previews only" | | Require SSO to view the site | Org/Team SSO with **Only SSO allowed (strict)** + team login protection | | Log in users *inside* your app | → netlify-identity skill | | Single company-wide app SSO, no double login | → Auth0 extension |

UI naming by plan (same mechanism, different labels)

The UI names differ by plan — the underlying protection is identical:

• **Credit-based Free / Personal / Pro:** per-project **Project visibility**; team-level **Default project visibility**.
• **Enterprise / Open Source / legacy (non-Credit-based):** per-site **Password Protection**; team-level **Default Password Protection settings**.

Legacy → Credit-based translation:

| Password Protection (old) | Project visibility (new) | |---|---| | No protection settings | Public | | Basic protection | Password | | Team protection | Private | | All deploys | Production and previews | | Non-production deploys only | Previews only |

Dashboard paths

**Credit-based (Project visibility):**

• Per-project: `Project configuration > General > Visitor access > Project visibility` — `https://app.netlify.com/projects/{site_name}/configuration/general/#project-visibility`
• Team default: `Team settings > General > Visitor access > Default project visibility` — `https://app.netlify.com/teams/{team_name}/settings/general#default-project-visibility`

**Enterprise / Open Source / legacy (Password Protection):**

• Per-site: `Project configuration > Access & security > Visitor access > Password Protection` — `https://app.netlify.com/projects/{site_name}/configuration/access#site-protection`
• Team default: `Team settings > Access & security > Visitor access > Default Password Protection settings` — `https://app.netlify.com/teams/{team_name}/settings/access#default-site-protection-settings`

Checklist: set a password (Credit-based, Pro)

1. Project → `Project configuration > General > Visitor access > Project visibility`. 2. **Edit visibility**. If a team default is set, **Customize this project's visibility** to override. 3. Select **Password**, enter the password (share it with visitors). 4. Choose **Preview access**: **Production and previews** or **Previews only**. 5. **Save**. Change later via **Change password**; remove by choosing **Public** or **Private**.

Checklist: Password Protection (Enterprise / OSS / legacy)

Per-site or team default via the paths above → **Configure Password Protection** → **Customize this site's protection settings** (if a default exists) → choose **Basic password protection** (single shared password) or **Team login protection** (Netlify team login, SSO-capable) → scope **All deploys** or **Non-production deploys only** → **Save**.

Checklist: require SSO to view a site

1. FIRST set up Organization SSO (`https://docs.netlify.com/manage/security/secure-netlify-access/configure-organization-saml-sso`) or Team SSO (`https://docs.netlify.com/manage/security/secure-netlify-access/configure-team-saml-sso`). 2. Configure Password Protection → **Team login protection**. 3. To force SSO, set the SSO config to **Only SSO allowed (strict)**.

SSO session symptoms (logged out mid-session, 401s)

SSO auth tokens **expire after 1 hour**. An SSO-protected site starts returning HTTP `401` once the token expires — this is the