> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Netlify

> Connect Netlify to CloudThinker for project inventory, deploy health checks, form intake audits, and extension inspection

Connect your Netlify account to enable CloudThinker agents to list teams and projects, check deploy state, read form submissions, and inspect extensions — plus approval-gated changes like starting a deploy or updating project settings.

Netlify authenticates with a **personal access token**. The token carries the same access as the Netlify user who created it, so that user's teams define what the agent can reach. No OAuth flow is required.

***

## Prerequisites

* A **Netlify account** with access to the teams and projects you want to investigate.
* A **personal access token** created from that account.
* Permission to create tokens in Netlify user settings.

<Info>
  Create the token from an account whose team membership matches what CloudThinker needs. Read operations never mutate Netlify resources — every write is approval-gated.
</Info>

***

## Setup

<Steps>
  <Step title="Create a personal access token">
    In Netlify, open your **user settings** and go to **OAuth applications → Personal access tokens**. Create a new token:

    * **Description**: `cloudthinker`
    * **Expiration**: choose a lifetime and plan to rotate

    Copy the token immediately — Netlify shows it only once.
  </Step>

  <Step title="Add the connection in CloudThinker">
    Navigate to **Connections → Netlify** and enter:

    * **Personal access token**: the token you just created

    Click **Connect**. CloudThinker verifies the token with Netlify and shows a **Connected** status with your site count.
  </Step>
</Steps>

<Warning>
  Copy the personal access token immediately after creation. You'll need to create a new token if it's lost.
</Warning>

***

## Connection details

| Field                                | Description                                                                           | Example |
| ------------------------------------ | ------------------------------------------------------------------------------------- | ------- |
| **NETLIFY\_PERSONAL\_ACCESS\_TOKEN** | Netlify personal access token for the team whose projects CloudThinker should inspect | —       |

***

## Required permissions

A Netlify personal access token inherits the permissions of the user who created it — there is no per-scope selection at creation time. Create it from an account that belongs to only the teams CloudThinker should reach, and give that account the smallest team role that still allows reading projects, deploys, forms, and extensions.

<Tip>
  Follow least privilege: use a dedicated Netlify user rather than an owner account, set an expiration, and rotate the token on the same schedule as your other credentials.
</Tip>

***

## Agent capabilities

Once connected, agents have read access to your Netlify teams, projects, and deploys.

| Capability          | Description                                                                                                                                                    |
| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Account & Teams** | Read the authenticated user, list teams, and inspect a single team                                                                                             |
| **Projects**        | List projects and inspect a project's configuration, URL, and current deploy                                                                                   |
| **Deploys**         | Inspect a deploy or the current deploy for a project, and flag failed or stale deploys                                                                         |
| **Forms**           | List the forms configured on a project with their submission counts                                                                                            |
| **Extensions**      | List extensions and read full extension details                                                                                                                |
| **Changes**         | Start deploys, create projects, change project settings, manage form submissions and environment variables, and change extension state — **requires approval** |

<Info>
  Every Netlify operation that is not a read is approval-gated. CloudThinker states the effect and the exact inputs, then waits for your confirmation before running it.
</Info>

### Verify the connection

```text theme={null}
@alex check the Netlify connection and list my teams and projects
```

### Example prompts

```text theme={null}
@alex list my Netlify projects with their current deploy state and #report as a table
@alex which Netlify projects have a failed or stale production deploy — #recommend what to fix first
@alex audit Netlify Forms across my projects and #report which ones collect submissions
```

***

## Troubleshooting

<Accordion title="Netlify personal access token is invalid or expired">
  CloudThinker verifies the token against the Netlify API before saving the connection, and Netlify answered 401 or 403. Reissue the token in Netlify user settings and reconnect.
</Accordion>

<Accordion title="Failed to get Netlify token during an agent run">
  The connection no longer holds a usable token. Confirm it still shows **Connected**, then reissue the personal access token and reconnect.
</Accordion>

<Accordion title="Agent reports 404 for a project or deploy">
  The token's user cannot see that project. Confirm the account that created the token belongs to the team owning it, then reissue the token from an account with access and reconnect.
</Accordion>

<Accordion title="Netlify API rate limit reached">
  Netlify answered 429. Retry later, and scope requests to a single team or project so the agent makes fewer calls per run.
</Accordion>

<Accordion title="A change was requested but never ran">
  Writes need explicit approval in the same turn. Approve the action when prompted; a rejected call is final and the agent will not retry it.
</Accordion>

***

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **Set token expiration** — choose an expiration when creating the token and plan to rotate it; Netlify tokens do not auto-rotate.
- **Approval for writes** — keep deploys, project settings, environment variables, and extension changes approval-gated rather than removing the guardrail.

***

## Related

<CardGroup cols={2}>
  <Card title="Vercel Connection" icon="https://mintcdn.com/cloudthinker/R1-llSMEloTP_DJf/images/icons/vercel.svg?fit=max&auto=format&n=R1-llSMEloTP_DJf&q=85&s=84c091b1a241ec5c1eaf822e2f155691" href="/guide/connections/vercel" width="24" height="24" data-path="images/icons/vercel.svg">
    Similar setup for Vercel projects and deployments
  </Card>

  <Card title="Approval" icon="shield-check" href="/guide/approval">
    How approval-gated actions work
  </Card>
</CardGroup>