A credential profile is an internal description of one usable API key source. It lets the plugin identify which provider, source, label, and fingerprint belong together without showing the secret.
Available Sources #
- Server configuration (constant/environment): a provider key supplied by server configuration and read during the request. It is not saved by the plugin.
- Encrypted database profile: a provider key entered on the Credentials tab and encrypted before storage in WordPress.
- Automatic: a resolver choice rather than another key. It chooses server configuration first and then an enabled saved profile.
Each provider currently has at most one WordPress-saved default key through the user interface. The plural term “profiles” reflects the possibility of both a server source and saved source, not a hidden collection that ordinary users must configure.
Why The Selector Sometimes Disappears #
If only one real source exists, selecting between Automatic and that same source would not change the result. The plugin hides the selector and uses Automatic. When both server and saved keys exist, it shows API Key so a feed or connection test can choose deliberately.
Fingerprints #
A fingerprint is the first part of a SHA-256 hash of the key. It helps identify whether two screens refer to the same key without revealing the key itself. It cannot be used to authenticate a provider request.
Rotation #
To replace a saved key, paste the new complete value and save. To rotate a server key, use the host’s secret-management process. Test the intended profile. If Automatic should switch from one source to another, remember that server configuration takes precedence while it remains present.
