Drupal AI Connector
Connecting an AI assistant to your website means giving something a way in, and you should know exactly what that is before you do it. On Drupal it is one credential, it belongs to you, and you can take it back at any moment without touching anything else on the site.
What Drupal asks for
An ordinary Drupal account made for this purpose, over HTTP Basic. The core Basic Authentication module ships switched off, which is why a correct password can still be refused until it is enabled.
Taking it back
Revoking is immediate and it is yours to do: the credential is removed on your own Drupal site, not requested from us. The next action the assistant attempts fails, the connection reports itself as broken, and nothing else on your website changes. There is no notice period and nothing to cancel first.
What the assistant can and cannot see
The assistant never receives your credential. It asks this connector for an action; the connector checks the action against what you authorised and then uses the credential itself. The credential is encrypted at rest and tied to the single website it was given for, so a copy of it taken from anywhere else is of no use.
What the platform does not allow
JSON:API is read-only out of the box. Until write operations are accepted at /admin/config/services/jsonapi, content can be listed and read but not created or changed.
Everything above describes what Drupal’s interface offers. None of it is marked verified yet, which in this product means exercised against a live installation with the date recorded.
Common questions
Do I give an AI company my Drupal password?
No, and not to us either in the usual sense. Drupal issues a separate credential for this, you create it yourself, and it is encrypted the moment it reaches us. Your login password is not involved and is never asked for.
What happens if I revoke it?
The connection stops working and nothing else does. Content already created stays exactly as it is — it is ordinary Drupal content, not something held by us. You can issue a new credential later and carry on.
Can one credential reach more than one website?
No. Each credential is bound to the one website it was created for, so a licence for one Drupal site cannot quietly be used on another — and a credential that leaked could not be either.
Getting started with Drupal AI Agent
Drupal AI Agent is not on sale yet. The product page tracks where it stands, and nothing is advertised before it works.