docs: explain private Netlify previews and the key storage

Author: augustoccesar

src/content/docs/guides/netlify-integration/frequently-asked-questions.mdx

@@ -23,14 +23,16 @@ If the log says `Could not report the GitHub check (403)` instead, the key belon
 ## Why does Netlify's secrets scan fail my build?
 
 Build tools like Next.js cache the build environment, so the scan can find secrets in the build output.
-The extension adds its own key, `ENDFORM_NETLIFY_API_KEY`, to the project's `SECRETS_SCAN_OMIT_KEYS` and keeps any keys you already listed.
+The extension's own key isn't an environment variable, so the scan never sees it.
 
-If you set `SECRETS_SCAN_OMIT_KEYS` in `netlify.toml`, which takes precedence, add `ENDFORM_NETLIFY_API_KEY` there.
-Do the same for other secrets your tests use, such as `E2E_NETLIFY_PREVIEW_PASSWORD`.
+Secrets your tests use, such as `E2E_NETLIFY_PREVIEW_PASSWORD`, can still trip the scan.
+Add them to the project's `SECRETS_SCAN_OMIT_KEYS` variable, or to `netlify.toml` if you set it there.
 
-## Why do all my tests fail on Netlify's password page?
+## Why do all my tests fail with 401 Unauthorized?
 
-Your Deploy Previews are protected. See [Password-protected Deploy Previews](/docs/guides/netlify-integration/password-protected-deploy-previews).
+Your Deploy Previews are protected, so your tests get Netlify's login or password page instead of your app.
+New Netlify projects are private by default.
+See [Private and password-protected Deploy Previews](/docs/guides/netlify-integration/password-protected-deploy-previews).
 
 ## Can I block a merge when the tests fail?
 

src/content/docs/guides/netlify-integration/index.mdx

@@ -27,8 +27,8 @@ Try it with our [demo repository](https://github.com/endformdev/playwright-tutor
 />
 
 <LinkCard
-  title="Password-protected Deploy Previews"
-  description="Let your tests get past Netlify's password page."
+  title="Private and password-protected Deploy Previews"
+  description="Let your tests reach Deploy Previews that Netlify protects."
   href="/docs/guides/netlify-integration/password-protected-deploy-previews"
 />
 

src/content/docs/guides/netlify-integration/installing-the-netlify-extension.mdx

@@ -43,7 +43,13 @@ You need to be an owner or admin of the Endform organization you connect, and yo
    });
    ```
 
-5. ### Show results on pull requests (optional)
+5. ### Make your Deploy Previews reachable
+
+   Endform's runners open your Deploy Previews like any visitor, so they can't sign in to Netlify.
+   New Netlify projects are private by default, so check **Project configuration > General > Visitor access > Project visibility** and set previews to public, or to password protected on Pro plans.
+   See [Private and password-protected Deploy Previews](/docs/guides/netlify-integration/password-protected-deploy-previews).
+
+6. ### Show results on pull requests (optional)
 
    [Install the Endform GitHub app](https://endform.dev/app/docs-link?link=settings-integrations) on the repository to get an **Endform** check on each pull request.
 
@@ -52,7 +58,7 @@ You need to be an owner or admin of the Endform organization you connect, and yo
 ## How it works
 
 Configuring a project creates an Endform API key for it.
-Netlify stores the key as a secret environment variable, `ENDFORM_NETLIFY_API_KEY`, that's only available to Deploy Preview builds.
+The extension keeps the key in its own settings for the project, not in your project's environment variables, and only uses it in Deploy Preview builds.
 
 On every Deploy Preview:
 

src/content/docs/guides/netlify-integration/password-protected-deploy-previews.mdx

@@ -1,16 +1,33 @@
 ---
-title: Password-protected Deploy Previews
-description: Let your tests get past Netlify's password page
+title: Private and password-protected Deploy Previews
+description: Let your tests reach Deploy Previews that Netlify protects
 sidebar:
   order: 2
 ---
 
 import { Aside, Steps } from "@astrojs/starlight/components";
 
-If your Netlify project protects its Deploy Previews, every request from your tests gets Netlify's protection page instead of your app.
-Endform doesn't bypass the protection for you, but your tests can get past it themselves.
+If your Netlify project protects its Deploy Previews, every request from your tests gets Netlify's login or password page instead of your app.
+In the deploy log, this usually shows as failing tests and `401 Unauthorized` responses.
 
-## Basic password protection
+Check your project's protection under **Project configuration > General > Visitor access > Project visibility**.
+Previews can be public, private, or password protected, separately from production.
+
+## Private Deploy Previews
+
+Netlify makes new projects private by default.
+A private project asks every visitor to sign in with Netlify, and Netlify has no way for automated tests to get past it.
+
+To test private Deploy Previews, change the preview visibility:
+
+- **On any plan:** make previews public.
+- **On Pro plans:** protect previews with a password instead, and let your tests enter it as described below.
+
+Production can stay private either way.
+
+## Password-protected Deploy Previews
+
+Password protection is only available on Netlify Pro plans.
 
 Netlify's password page is a form that posts a `password` field.
 When the password is right, Netlify sets a cookie that gives access to the whole deploy.
@@ -24,7 +41,7 @@ Your tests can post the password once and add that cookie to every browser conte
 
    Variables that start with `E2E_` are [sent to Endform's remote runners](/docs/explanation/transfer-state-to-remote-runners#environment-variables) automatically.
 
-   Also add `E2E_NETLIFY_PREVIEW_PASSWORD` to the project's `SECRETS_SCAN_OMIT_KEYS` variable, next to `ENDFORM_NETLIFY_API_KEY`.
+   Also add `E2E_NETLIFY_PREVIEW_PASSWORD` to the project's `SECRETS_SCAN_OMIT_KEYS` variable.
    Build tools like Next.js cache the build environment, so Netlify's secrets scan would otherwise find the password in the build output and fail the build.
 
 2. ### Get the cookie
@@ -118,10 +135,3 @@ The [demo repository](https://github.com/endformdev/playwright-tutorial) uses th
 <Aside title="Using a coding agent?">
 Ask it to: "Make our Playwright tests work against password-protected Netlify Deploy Previews. Post `E2E_NETLIFY_PREVIEW_PASSWORD` to the base URL once, take the cookie from the `Set-Cookie` header, add it to every browser context through a `context` fixture override, and send it as a `Cookie` header on direct `fetch` calls. Do nothing when the variable isn't set."
 </Aside>
-
-## Netlify team login and SSO
-
-Team login protection asks visitors to sign in with a Netlify account, so automated tests can't get past it.
-Netlify doesn't document a way for automated requests to get past it.
-
-To test protected Deploy Previews, switch the protection to a basic password, or turn off protection for Deploy Previews in your project's visitor access settings.