restricted-access
Use when a val's HTTP endpoints should not be open to the whole internet — limiting an app to a team, understanding why an endpoint redirects to a login page, letting a webhook through, or identifying which Val Town user is viewing an app. Covers app access (`httpPrivacy`), org grants, bypass tokens for automation, and the `X-Val-Town-User` identity header. For building your own login flow inside a val, see the `oauth` skill instead.
Install
With your agent
Install OMGSkills skill "val-town/plugins:plugin/skills/restricted-access" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/val-town/plugins /tmp/plugins && ln -s /tmp/plugins/plugin/skills/restricted-access ~/.claude/skills/restricted-accessFrom README
Restricted App Access A val has two independent access settings. Changing one does not change the other: Code (privacy: public / unlisted / private) — who can read the source on val.town. App access (httpPrivacy: public / restricted) — who can call the val's HTTP endpoints. A val can have private code and a wide-open endpoint, or public code and a locked-down endpoint. updateval's privacy field only moves the first one; app access is changed with sethttpprivacy. Restricted app access is available to organizations that have the feature enabled. Vals created in such an org may default to restricted — always read httpPrivacy off a getvaldetail, listvals, createval, or remixval response rather than assuming a new val's URL is open. Is this the right tool? Two different things both sound like "make my app require a login": Restricted app access (this skill) gates the endpoint at the platform edge, before your code runs. Requests from people without access never reach the val.
More from this repo
blob-storage
Used when a val needs simple key/value persistence — JSON documents, cached responses, uploaded files, or binary assets.
client-side-js
Used when a val needs to ship JavaScript that runs in the browser — React apps, vanilla DOM scripts, canvas/games,...
create-skill
Used when the user wants to persist a preference, skill, or knowledge.