It's a reasonable thing to hesitate over. You're pasting a credential into a chat box so a program can act as you. Nobody should do that without asking what it's actually allowed to do.
Here's the straight answer, including the parts that aren't reassuring.
What the code can do
Publish websites to your account. Create projects, deploy files, read your usage, add a domain if your plan includes one, delete a project.
That's the whole list. It's the same set of things you can do from your dashboard, which is deliberate — it's an alternative way to operate your account, not a special back door with extra powers.
What it can't do
- Sign in as you. It's not your password. There's no way to turn it into a dashboard session.
- Read or change your password. It has no access to your login at all.
- See your card details. Payments go through Stripe; we never hold your card number, so neither can anything using the code.
- Change your plan or spend money. Upgrading happens on the billing page, behind your actual login. An AI can tell you that you need to upgrade. It can't do it.
- Reach another account. The code is scoped to yours.
The worst realistic case is that someone publishes junk to your sites or deletes them. That's genuinely bad. It is not "someone took over your account".
Why it stops being visible
After the first time your AI uses the code, your dashboard shows a short prefix and nothing more. We can't show you the whole thing again, and that's on purpose.
A credential you can read off a screen at any moment is one that gets read off a screen. Over a shoulder, in a screen share, in a screenshot you post while asking for help, in a support session where you shared your window. Once the code is in use, showing it again has no upside — your AI already has it — and several downsides.
If you lose it, you don't recover it. You replace it, which invalidates the old one immediately, and the new one is visible until it gets used.
We think that trade is right. It does mean "just paste it again" isn't an option, and an assistant that asks you to is telling you to do something impossible — the answer there is a new code, not a search.
If it leaks
Say you post it in a forum while asking why a deploy failed. It happens.
Delete it and make a new one. Takes one click. The old one stops working immediately — not at the end of a session, not after a cache expires. Anything using it starts failing at once, including your own assistant, which will need the new one.
The websites you already published stay up. They're files being served; they don't care which code deployed them.
That's the whole recovery. No support ticket, no waiting.
The uncomfortable parts
A page about safety that only lists reassurances isn't being honest.
You are trusting the AI's operator. The code goes into a chat with OpenAI, Anthropic, Google or whoever. It sits in that conversation's history on their systems. We have no visibility into that and no control over it. If you don't trust a provider with a publishing credential, don't paste one in.
Prompt injection is real. If you ask an assistant to build a site based on content it fetched from somewhere, and that content contains instructions, a poorly-built agent can be talked into acting on them. The blast radius here is limited to your own projects — but "publish something embarrassing to your own site" is a real outcome. Be careful about asking an AI to build from pages you don't control.
Anything you publish is public. The websites are on the open internet. Don't put passwords, API keys or personal information into a page and expect it to stay unseen. If your AI wants to hardcode a key into a page, that's a mistake — secrets belong in the environment variables, which are write-only and never shown back.
We could be compromised. Every hosting provider could. What we do about it: your code is stored hashed, so a database leak doesn't hand anyone a working credential. Environment variables are encrypted. Deployed apps can't open raw network connections or reach hosts that aren't allowlisted, which is a containment measure for exactly this reason.
Sensible habits
- One code per assistant. If you use two, give them separate codes, so revoking one doesn't break the other.
- Replace it if you've shared a screen while it was visible. It's free.
- Check your projects list occasionally. It's the fastest way to notice something you didn't ask for.
- Don't put it in a file you commit. It belongs in a chat window or a connector's settings, not in your source code.
The honest summary
The code is a publishing key. It publishes, and it does not do anything else. It's revocable in one click, it's invisible after first use so it can't be read off your screen later, and losing it costs you thirty seconds.
That's a smaller thing to hand over than most people assume when they hesitate — and the hesitation is still the right instinct.