The key you give your AI agent: what it can do and how to keep it safe
When you connect an agent to aiput.site, you paste a message that contains a key starting with SITEAI_. That key is how aiput.site knows the agent is acting for you. Here is what it gives the agent, and what it does not.
What the key allows
Everything to do with your sites:
- create sites, publish and update them;
- list your sites and their versions, and roll back;
- rename and delete sites.
Anyone who has the key can do the same: publish something else at your addresses, or delete your sites.
What it does not allow
- Signing in to your dashboard. The key is not your account password; the dashboard needs your Google sign-in or a code sent to your email.
- Payments. It cannot change your plan or see your card.
- Anything outside aiput.site. It gives no access to your email, your other accounts or your computer.
- Running up a bill. The price of your plan is fixed, and the number of sites is capped by it.
Where the key ends up
- In your dashboard. The message with the key is always there, so you do not need to save it anywhere else.
- In your agent's settings. The agent stores it in its MCP settings file. Ask it to use its global settings, in your user folder, rather than a file inside the project. Then the key never sits next to your website files.
- In the chat where you pasted it.
How keys leak
- a screenshot or a copied chat log that includes the message;
- sending the message to someone "to help set it up";
- a project folder with the agent's settings inside, shared or published;
- a public code repository.
If it leaks: reset it
In your dashboard, the Connect your AI coding assistant section has a Reset the code button. The old key stops working immediately; your sites stay online as they are. Copy the new message and paste it to your agent: it replaces the old key and asks you to restart it.
If someone has already changed a site, roll it back to a good version — here is how.
Good habits
- Read before you confirm. Agents usually ask before running a tool. When the tool is a deletion, check what exactly is being deleted.
- Keep your working folder. Versions on aiput.site are for rolling back, not a backup.
- One key, one person. Do not pass it on; anyone who needs to publish can get their own account.
New to agents and tools? What is MCP explains how the connection works.