BFF Layer Design & Security

When this skill applies

Use this skill when building or modifying any headless VTEX storefront that communicates with VTEX APIs — whether a custom storefront, mobile app, or kiosk.

• Setting up a BFF (Backend-for-Frontend) layer for a new headless project
• Deciding which VTEX APIs need server-side proxying vs direct frontend calls
• Implementing credential management (VTEX_APP_KEY, VTEX_APP_TOKEN, VtexIdclientAutCookie)
• Reviewing a headless architecture for security compliance

Do not use this skill for:

• Checkout-specific proxy logic and OrderForm management (use headless-checkout-proxy)
• Search API integration details (use headless-intelligent-search)
• Caching and TTL strategy (use headless-caching-strategy)

Decision rules