Most site owners should save keys through GravityOps -> AI Feed -> Credentials.
Save A Key #
- Paste the Anthropic key into Anthropic API Key and/or the OpenAI key into OpenAI API Key.
- Select Save Credentials.
- Leave a field blank on later saves to keep its existing value.
- To replace a key, paste the new complete key and save again.
The plugin encrypts keys before storing them in the WordPress database. After saving, it never shows the full key again. Instead, the page shows the source, availability, and a short fingerprint. The fingerprint helps distinguish keys without revealing them.
Test A Key #
Use Test Anthropic or Test OpenAI. A successful test confirms that the plugin could select a key and authenticate a small, non-billable request to the provider’s Models endpoint. It does not display the secret and does not generate user content.
A restricted provider key may allow text or image generation while denying permission to list models. In that case, the test shows an inconclusive permission warning instead of reporting that the credential is invalid. Confirm in the provider console that an Anthropic key allows message generation or that an OpenAI key allows image generation. A successful feed run is the final check of the permission the plugin actually uses.
When both a server-managed key and a WordPress-saved key exist, the test form shows an API Key selector:
- Automatic tests the key the plugin would normally choose.
- Server configuration (constant/environment) tests the server-managed key.
- Anthropic default or OpenAI default tests the encrypted key saved in WordPress.
When only one usable source exists, the selector is hidden because there is no meaningful choice.
What Automatic Means #
Automatic looks for a provider key in this order:
- The provider-specific PHP constant.
- The provider-specific environment variable.
- An enabled encrypted key saved in WordPress.
If a feed has more than one real source available, its API Key setting can deliberately choose one. Otherwise the feed omits that setting and uses Automatic.
When A Test Fails #
Confirm that the key was copied completely, belongs to the correct provider, has not been revoked, and has the required API access. Then check provider billing and account status. If a saved key is reported as unavailable or cannot be decrypted, re-enter it; WordPress security-key or dedicated encryption-key changes can invalidate an older encrypted value.
