How to Give an AI Agent Access to Your Website Without Handing Over Your Login

Create a separate, limited account or a scoped API token for the agent — never your own owner login. Every platform below has a built-in role that can edit existing content without also being able to change billing, delete the site, manage other users, or touch checkout and payments. This post is the platform-by-platform reference for which role or token to use, how to set it up, and how to revoke it. It assumes you already know the general routes an AI agent uses to reach a site; if not, read how ChatGPT, Claude, Codex or Cursor can edit an existing website first. This post doesn't repeat that — it only covers permissions.

Which role is the lowest that can edit content on each platform?

Squarespace. Open Settings → Contributors and invite a contributor. The Website Editor permission lets a contributor add products, blocks, and other content to existing pages, and edit blog posts and events, but Squarespace's own documentation notes they can't add new pages, delete pages, add code injection, or make style changes (Squarespace). Only owners and administrators can send this invitation.

Wix. Go to Settings → Roles & Permissions, and either assign a predefined role or build a custom one with only the content-edit permissions the task needs — Wix explicitly supports custom roles so you aren't stuck choosing between "everything" and "almost nothing" (Wix). Invite the collaborator by email from the same Roles & Permissions screen.

Webflow. Webflow separates a Workspace role from a Site role. The Content editor Site role only edits content; it can't design with all features the way the Designer role can (Webflow). This is the role to assign an agent that only needs to change copy or CMS entries, not layout.

WordPress (self-hosted or WordPress.com). WordPress's built-in roles are Administrator, Editor, Author, Contributor and Subscriber. Editor is the lowest role that can edit and publish any existing page or post; Author and Contributor can only manage their own posts and can't touch Pages at all in core WordPress (WordPress.org). None of these roles can install plugins, switch themes, or manage other users — that requires Administrator.

Shopify. From Settings → Users, click Roles and create a custom role with only the permissions the task needs — for example theme or page editing — rather than a default role. Shopify's own documentation on managing roles describes exactly this: a role "contains all the granular permissions that a user requires to do that job," assignable individually (Shopify). Leave out orders, finances, and customer data permissions unless the task genuinely needs them.

How do I invite a separate account for the agent?

The mechanics differ by platform, but the shape is the same everywhere: create the account or role first, with the narrowest permission set, then send the invite to an email address you control (not the agent's own credentials, since these tools don't hold email inboxes to accept invitations). Squarespace, Wix, Webflow and Shopify all send an email invitation that the new collaborator (you, signed in separately, or whoever operates the agent's session) must accept before access is active; Shopify's staff invitations expire after seven days (Shopify). WordPress creates the user directly from the admin, so double-check the role before saving.

How do I revoke access when the work is done?

• Squarespace: Settings → Contributors → remove the contributor.
• Wix: Roles & Permissions → remove the collaborator or revoke the role.
• Webflow: Workspace or Site settings → remove the member's seat.
• WordPress: Users → delete or change the role of the account; for Application Passwords specifically, revoke the individual password from the user's profile without touching their login password.
• Shopify: Settings → Users → deactivate the staff account or remove the custom role.

Do this the same day the task finishes, not "eventually" — an unused editor account is a standing liability, not a convenience for next time.

Should the agent use a browser session or an API token?

Browser agents (ChatGPT's cloud browser / agent mode, Claude's built-in browser in Cowork, or Claude in Chrome) sign in and act as whatever account you authorize inside that browser session — they don't have their own separate identity on the platform. That means the account you sign the agent's browser session into should already be the limited role above, not your owner login. OpenAI and Anthropic both publish safety guidance for this because a browser agent can see and act on whatever the signed-in account can reach; Anthropic's guidance recommends a separate browser profile without access to sensitive accounts (OpenAI, Anthropic).

API tokens are a separate door: a scoped credential, not a login. WordPress's Application Passwords authenticate a specific integration without exposing the account's real password (WordPress). Shopify custom apps declare specific access scopes so "request only the data your app needs to function" is the platform's own stated design principle (Shopify). Webflow's API scopes come in separate read and write pairs, and its developer docs advise requesting only the scopes an integration actually needs (Webflow). Wix API keys similarly grant "a custom set of permissions" scoped to specific business data rather than full account control (Wix).

Prefer a token over a browser session when the platform offers one for the task: a token is easier to scope narrowly, easier to revoke without disturbing a human user's login, and doesn't require sharing a live, signed-in browser at all.

What about two-factor authentication?

Keep 2FA enabled on your own owner account regardless of what access an agent has — that account is what actually controls billing, domains and every other user. Where the platform lets you require 2FA for every user on the site, turn it on for the agent's limited account too. Shopify, for instance, can enforce two-step authentication across an entire organization, and Shopify itself may require it on individual accounts "even if you didn't turn it on yourself" (Shopify). A limited role is a smaller blast radius, not an excuse to skip authentication on it.

What should I never give an AI agent?

• Your owner or administrator login password, on any platform.
• A one-time 2FA code, a recovery code, or a passkey.
• Payment method details or billing account access.
• Your domain registrar login or DNS host credentials.
• The personal email account tied to the site's primary owner.
• An API secret or access token pasted directly into a chat prompt instead of the tool's own secure credential storage.

None of these are things a content-editing task legitimately needs. If a tool or a workflow asks for one of them to do something as ordinary as "update this page," that's the signal to stop and use a scoped account or token instead.

For the general question of what an AI agent can and can't do once it has access, see our main guide. For platform-specific detail on what each vendor's own AI tools can already do — separate from the outside-agent question this post covers — see Squarespace and Wix.