Skip to main content
Connect your Netlify account to enable CloudThinker agents to list teams and projects, check deploy state, read form submissions, and inspect extensions — plus approval-gated changes like starting a deploy or updating project settings. Netlify authenticates with a personal access token. The token carries the same access as the Netlify user who created it, so that user’s teams define what the agent can reach. No OAuth flow is required.

​
Prerequisites

  • A Netlify account with access to the teams and projects you want to investigate.
  • A personal access token created from that account.
  • Permission to create tokens in Netlify user settings.
Create the token from an account whose team membership matches what CloudThinker needs. Read operations never mutate Netlify resources — every write is approval-gated.

​
Setup

1

Create a personal access token

In Netlify, open your user settings and go to OAuth applications → Personal access tokens. Create a new token:
  • Description: cloudthinker
  • Expiration: choose a lifetime and plan to rotate
Copy the token immediately — Netlify shows it only once.
2

Add the connection in CloudThinker

Navigate to Connections → Netlify and enter:
  • Personal access token: the token you just created
Click Connect. CloudThinker verifies the token with Netlify and shows a Connected status with your site count.
Copy the personal access token immediately after creation. You’ll need to create a new token if it’s lost.

​
Connection details

​
Required permissions

A Netlify personal access token inherits the permissions of the user who created it — there is no per-scope selection at creation time. Create it from an account that belongs to only the teams CloudThinker should reach, and give that account the smallest team role that still allows reading projects, deploys, forms, and extensions.
Follow least privilege: use a dedicated Netlify user rather than an owner account, set an expiration, and rotate the token on the same schedule as your other credentials.

​
Agent capabilities

Once connected, agents have read access to your Netlify teams, projects, and deploys.
Every Netlify operation that is not a read is approval-gated. CloudThinker states the effect and the exact inputs, then waits for your confirmation before running it.

​
Verify the connection

​
Example prompts

​
Troubleshooting

CloudThinker verifies the token against the Netlify API before saving the connection, and Netlify answered 401 or 403. Reissue the token in Netlify user settings and reconnect.
The connection no longer holds a usable token. Confirm it still shows Connected, then reissue the personal access token and reconnect.
The token’s user cannot see that project. Confirm the account that created the token belongs to the team owning it, then reissue the token from an account with access and reconnect.
Netlify answered 429. Retry later, and scope requests to a single team or project so the agent makes fewer calls per run.
Writes need explicit approval in the same turn. Approve the action when prompted; a rejected call is final and the agent will not retry it.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Set token expiration — choose an expiration when creating the token and plan to rotate it; Netlify tokens do not auto-rotate.
  • Approval for writes — keep deploys, project settings, environment variables, and extension changes approval-gated rather than removing the guardrail.

Vercel Connection

Similar setup for Vercel projects and deployments

Approval

How approval-gated actions work