Anything included in your page source is public, and the Pixy script tag is no exception.
That's why the script tag doesn't grant access to anything. Its only job is to identify your project. Editing is protected separately.
The first time you want to edit a website, you approve that browser for that site. After that, Pixy recognizes the approval automatically whenever you come back.
Anyone else visiting the same page sees nothing different. Without approval, the script tag doesn't enable editing or expose your project.
Your AI agent uses its own private key, which never appears in your website. If you regenerate a project's keys, existing approvals are withdrawn and new ones must be granted.
The result is a simple security model. The script tag is public, editing stays private, and you can leave Pixy on your production website with confidence.
Open your website with ?pixy to approve your browser. You'll find the link on your project's page.