Permissions & Security
Permissions
You pick these when you create a token:
| Permission | Allows |
|---|---|
| See sites | List the sites the token covers (always on) |
| Read files | Read content, schemas and history, and clone the repository (always on) |
| Edit content | Files in the content and config folders from Project Settings → Configure |
| Manage media | Files in the media folder |
| Edit schemas | .sitepins/schema and .sitepins/snippet |
| Edit code | Every other file, including .sitepins/config.json and package.json. Off by default. |
| Branches and pull requests | Commit to other branches and open pull requests |
How changes are saved is a separate choice. Commit directly writes to the site’s branch. Open a pull request puts every change on a sitepins/… branch with a pull request for you to review.
Never allowed
Whatever permissions you grant, agents can’t:
- write CI files:
.github/workflows/,.github/actions/,.gitlab-ci.yml,.gitea/and.forgejo/workflows,.circleci/,.gitmodules - manage organization members, billing, or project settings
- delete projects or connect and disconnect Git accounts
An agent can never do more than you can: if you lose access to a site or leave the organization, the agent does too.
How access is protected
- Scoped, expiring tokens. Each token works only for the sites and permissions you chose, expires after at most 90 days, and is stored only as a hash. Treat it like a password: anyone with it can act as you on those sites.
- Git credentials never leave Sitepins. Agents never receive a GitHub or GitLab token, even when they clone a site. Sitepins commits on their behalf, and for GitHub it uses a short-lived token limited to that one repository.
- Checked on every request. Each request re-checks the token, your membership, the site, and the permission, so revoking works immediately.
- Conflict protection. Agents can’t silently overwrite changes made by people or other agents.
- A full record. Every change appears in Activity with the agent’s name, and in the commit message.
Self-hosting
AI agent access works on every self-hosted install with no extra setup. It uses the API’s BASE_URL, the web app’s URL (APP_URL, or the first CORS_ORIGINS entry) and the shared INTERNAL_API_SECRET. See Environment Variables.
Last updated on