Agent skill · software engineering · jeremylongshore
firecrawl-enterprise-rbac
Design and audit Firecrawl team roles, API-key ownership, endpoint and format restrictions, IP restrictions, SSO, and separation of duties. Use when governing enterprise access. Trigger with "Firecrawl RBAC", "restrict a Firecrawl key", or "Firecrawl enterprise controls".
Why this skill is useful
Adds specific implementation patterns for Firecrawl's RBAC system, including API key management and domain restrictions that the AI wouldn't reliably generate on its own.
What it needs
Requires firecrawl account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Firecrawl Enterprise Access Governance Overview Translate Firecrawl's actual team and key controls into a least-privilege operating model. Do not invent fine-grained roles that the dashboard does not provide. Prerequisites The target repository or integration path and the requested operator outcome. The source authorization, data classification, and environment policy. Current Firecrawl documentation, credentials only when needed, and an owner for approvals. Current Contract The dashboard documents two team roles, Admin and Member, with administrative actions reserved for Admins. Enterprise key restrictions can enforce per-key endpoint and output-format allowlists; team-scoped IP restrictions can restrict authenticated origins; SSO is an enterprise capability. Empty restriction lists mean unrestricted, and changes can take time to propagate. Authentication For authenticated Cloud operations, inject FIRECRAWLAPIKEY from an approved secret manager. REST requests use Authorization: Bearer with the key. Never print, commit, transmit, or place a key in a URL. Keyless access is suitable only where the current documentation explicitly allows it and the workload accepts its limits; production workflows should make identity and team ownership explicit. Instructions 1. Inventory teams, Admins, Members, API keys, service owners, environments, permitted endpoints/formats, source networks, spend limits, SSO state, and break-glass access. 2. Remove shared human keys from services. Assign each workload an owned key and secret-manager path with a documented purpose and rotation/revocation procedure. 3. Use the smallest team role. Keep invitations, member removal, role changes, key administration, billing, and enterprise-control changes behind Admin review. 4. For eligible enterprise keys, configure non-empty endpoint and format allowlists; remember that an empty list does not restrict that dimension. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/firecrawl-enterprise-rbac