# restricted-access

> Claude/Codex skill by [@val-town](https://omgskills.com/library/val-town/index.md) · 10 stars · Updated 2026-10-13

Use when a val's HTTP endpoints should not be open to the whole internet — limiting an app to a team, understanding why an endpoint redirects to a login page, letting a webhook through, or identifying which Val Town user is viewing an app. Covers app access (\`httpPrivacy\`), org grants, bypass tokens for automation, and the \`X-Val-Town-User\` identity header. For building your own login flow inside a val, see the \`oauth\` skill instead.

## Install

```sh
git clone https://github.com/val-town/plugins /tmp/plugins && ln -s /tmp/plugins/plugin/skills/restricted-access ~/.claude/skills/restricted-access
```

## From README

Restricted App Access A val has two independent access settings. Changing one does not change the other: Code (privacy: public / unlisted / private) — who can read the source on val.town. App access (httpPrivacy: public / restricted) — who can call the val's HTTP endpoints. A val can have private code and a wide-open endpoint, or public code and a locked-down endpoint. updateval's privacy field only moves the first one; app access is changed with sethttpprivacy. Restricted app access is available to organizations that have the feature enabled. Vals created in such an org may default to restricted — always read httpPrivacy off a getvaldetail, listvals, createval, or remixval response rather than assuming a new val's URL is open. Is this the right tool? Two different things both sound like "make my app require a login": Restricted app access (this skill) gates the endpoint at the platform edge, before your code runs. Requests from people without access never reach the val.

## Links

- HTML page: https://omgskills.com/library/val-town/plugins/plugin/skills/restricted-access/
- GitHub: https://github.com/val-town/plugins
- Author: [@val-town](https://omgskills.com/library/val-town/index.md)

## More from this repo

- [blob-storage](https://omgskills.com/library/val-town/plugins/plugin/skills/blob-storage/index.md) — Used when a val needs simple key/value persistence — JSON documents, cached responses, uploaded files, or binary assets.
   - [@val-town](https://omgskills.com/library/val-town/index.md) · 10 stars
- [client-side-js](https://omgskills.com/library/val-town/plugins/plugin/skills/client-side-js/index.md) — Used when a val needs to ship JavaScript that runs in the browser — React apps, vanilla DOM scripts, canvas/games,...
   - [@val-town](https://omgskills.com/library/val-town/index.md) · 10 stars
- [create-skill](https://omgskills.com/library/val-town/plugins/plugin/skills/create-skill/index.md) — Used when the user wants to persist a preference, skill, or knowledge.
   - [@val-town](https://omgskills.com/library/val-town/index.md) · 10 stars