Site Pin Gate

site-pin-gate

[](https://agentskills.io) [](https://www.skills.sh) [](https://docs.claude.com/en/docs/claude-code/skills) [](https://developers.openai.com/codex/skills) [](https://github.com/google-gemini/gemini-cli/blob/main/docs/cli/skills.md)

An [Agent Skill](https://agentskills.io) that teaches an agent to put a shared-PIN gate in front of an entire **Next.js App Router** site from the proxy or middleware layer: one env var arms it, a self-contained unlock page sets an HMAC-derived `HttpOnly` cookie, and the app behind it stays untouched. Unset the variable and the gate is gone.

**Everything dangerous in a gate lives in the two places it touches the outside world: the return path it redirects to, and the cookie it hands out.** The rest is a form and a cookie check. Get those two right and one shared PIN is a complete answer for the weeks before a launch, a client or investor preview, or a staging domain: everyone who should see the site can be told the PIN, and nobody else, crawlers included, sees anything but a 401 page. It is not user authentication and not per-route authorization, because a shared PIN cannot be revoked for one person.

This skill was written by the engineer who has shipped this module. The earlier implementation it was audited against was a temporary gate on a marketing site kept private ahead of its launch. The templates hold the properties a gate has to hold: an unlock that can only return to the site's own origin, a redirect the browser follows as a GET so the PIN is never sent twice, a cookie that is opaque to anyone without the server's secret, comparisons that take the sa