Server-Managed Credentials

Developers and managed hosts can supply provider keys outside the WordPress database. This is optional. Most site owners should use the Credentials tab instead.

Provider Constants Or Environment Variables #

The plugin recognizes:

define( 'GOAIF_ANTHROPIC_API_KEY', 'your-anthropic-api-key' );
define( 'GOAIF_OPENAI_API_KEY', 'your-openai-api-key' );

The same names can be provided as environment variables. Constants take precedence over matching environment variables. Do not add real keys to a file tracked by Git. Use the site’s existing secret-management process and never expose values in logs or support output.

These provider constants are read directly during a request. They are not copied into the WordPress database and do not require GOAIF_CREDENTIAL_ENCRYPTION_KEY.

Optional Database Encryption Key #

GOAIF_CREDENTIAL_ENCRYPTION_KEY affects only API keys entered through the WordPress Credentials tab. It is not an API key and it does not encrypt provider constants.

Without this setting, the plugin derives an encryption password from the site’s WordPress salts. That is appropriate for most installations. A dedicated key separates saved-credential encryption from WordPress salt rotation, but it must be a Defuse Crypto ASCII-safe key generated for this purpose—not an arbitrary passphrase.

Example shape:

define( 'GOAIF_CREDENTIAL_ENCRYPTION_KEY', 'def00000...' );

Treat the actual value as a secret. Generate it with the Defuse Crypto library used by the plugin, store it outside source control, and back it up through the host’s secret-management system.

From the plugin directory, a developer can generate the correctly formatted value with:

vendor/bin/generate-defuse-key

The command prints one ASCII-safe key. Store that complete output as the GOAIF_CREDENTIAL_ENCRYPTION_KEY environment variable in the host’s secret manager. If the host requires a PHP constant instead, load it from protected, non-versioned server configuration before WordPress loads the plugin. Keep a recoverable copy in the approved password vault or secret backup; do not paste it into Git, deployment logs, support tickets, or ordinary documentation.

Choose The Method Before Saving Keys #

The plugin uses the dedicated encryption key whenever it is present and otherwise uses WordPress salts. Adding, removing, or replacing the dedicated key does not automatically re-encrypt values saved with the previous method. After such a change, re-enter every WordPress-saved provider key.

Likewise, rotating WordPress salts makes salt-encrypted provider keys unreadable. Server-managed provider keys are unaffected because they were never stored as encrypted database credentials.