Credentials #
define( 'GOAIF_ANTHROPIC_API_KEY', '...' );
define( 'GOAIF_OPENAI_API_KEY', '...' );Matching environment variables are also recognized. PHP constants take precedence. These values are provider secrets and are never database-encrypted by the plugin.
define( 'GOAIF_CREDENTIAL_ENCRYPTION_KEY', 'def00000...' );Optional Defuse Crypto ASCII-safe key used only for credentials saved through WordPress. Choose the encryption method before saving credentials; changing it requires re-entering saved values.
Trusted Proxies #
define( 'GOAIF_TRUSTED_PROXIES', '192.0.2.0/24, 2001:db8::/32' );Entries are merged with Controls values. Invalid entries are ignored. Use only official ranges for the service directly in front of WordPress.
Provider Timeouts #
define( 'GOAIF_PROVIDER_TIMEOUT', 60 );
define( 'GOAIF_ASYNC_WALL_CLOCK_LIMIT', 120 );GOAIF_PROVIDER_TIMEOUT overrides the source-aware provider HTTP timeout. Without it, frontend text, streamed text, and frontend image requests use 60 seconds; other synchronous requests use 45 seconds. Async and workflow runs use the async wall-clock value as their provider ceiling.
Public Limits #
The default visitor limit is 10 requests in 3,600 seconds. The configured limit is constrained to 1–100 and the window to 60–86,400 seconds. The network ceiling is three times the visitor limit, capped at 100.
Storage #
Plugin options use the goaif_ prefix. Custom tables store usage events, generation tokens, rate limits, and image sessions. Uninstall removes plugin options, scheduled cleanup, tables, entry metadata, and lock transients.
Runtime Sources #
Internal source names include submission_sync, submission_async, realtime_ajax, realtime_stream, image_stream, rerun, and workflow_step. Trigger matching applies to normal submission/frontend sources; a rerun or workflow step is an explicit administrator/workflow action.
