⚡ Webflow shut down the legacy Editor & white-label on Aug 4 — see the 5-minute replacement →

Install Qixoo on an existing site

Adding Qixoo takes about a minute and changes nothing about how your site is built or where it is hosted.

The snippet

<script src="https://qixoo.app/qixoo.js" data-key="YOUR_SITE_ID" defer></script>

Paste it once, before </head>, on every page. Then publish or redeploy the site as you normally would.

YOUR_SITE_ID is the Site ID shown on your site card in the dashboard — click the copy icon next to it.

Step by step

  1. Sign in at https://qixoo.app/dashboard/. Email magic link or Google — no password. New emails get an account automatically on the Free plan.
  2. Sites → + Add site → enter a name and the site's URL.
  3. On the new site card open Connect → Install.
  4. Copy the snippet and paste it into your HTML, or copy the AI install prompt and hand it to your coding assistant (Cursor, Claude, v0, Lovable) — it will insert the tag for you.
  5. Publish the site, then click Open editor on the card. Your live site opens with an editing overlay.

Nothing changes for visitors until you make an edit and save it.

Where to paste it, by platform

  • Hand-written HTML — into the <head> of every page.
  • A framework or static site generator — into the shared layout or template, so it lands on every page.
  • Site builders — most have a "Custom code → head" setting; use that.
  • Webflow — Site Settings → Custom Code → Head Code. This requires a paid Webflow site plan.
  • WordPress — the theme's header.php, or any header-scripts plugin.

Is the Site ID a secret?

No, and it is not a password. The Site ID only identifies which site the editor and the public content API are talking about. It cannot sign anyone in, cannot change your content, and cannot reveal anything that is not already public on your page. Editing requires being signed in to your Qixoo account, and the editor uses a separate short-lived token that never appears in your HTML. The Site ID sitting in your page source is as harmless as the page address itself.

In the developer content API the HTTP header is still literally X-API-Key — that is the wire format and carries the same Site ID value.

Notes

  • Sites connected earlier with the older vibe-cms.js script name keep working; no action is needed.
  • The loader is about 3 KB, sets no cookies, does no tracking and sends visitor data to no one.
  • Single-page apps that re-render the DOM after load are supported on a best-effort basis. Test one page before promising it to a client. Server-rendered HTML and static exports are the reliable case.

Next: Editing · Client access