Netlify access control — pick the protection layer

This skill routes you to the correct protection layer. It does not teach each one. These settings have no public API, CLI command, or MCP tool. Never curl api.netlify.com or read local auth tokens to inspect or change them — give the user the dashboard path and checklist. On failure, report what you tried and stop.

First: disambiguate "auth" — three unrelated layers

Users constantly conflate these. Identify which one is meant before recommending anything.

1. Netlify Identity — "who is this user inside my app." Issues nf_jwt. → route to the netlify-identity skill; not covered here.
2. Password Protection / project visibility — "can this request load the site at all." Covered here.
3. Team/Org SAML SSO — "can you log in to the Netlify dashboard." Gates dashboard access; also underlies team-login site protection.

Sessions are separate. The same provider (e.g. Google) can appear twice unrelated — Identity OAuth for app users vs. SAML IdP for team members.

Double-login footgun: a Password-Protection/team-login perimeter session and an Identity app session have no bridge — no shared cookie, no header forwarding, no JWT exchange. Don't try to wire them together. For the combined layered pattern and its tradeoffs, see references/two-layer-pattern.md.

Want company-wide app SSO with a single sign-in (no double login)? Recommend the Auth0 extension federating to the corporate IdP before the two-layer stack.

Decision guide (this skill's job)