Credentials Vault

Why a vault

By default, WordPress plugins store their secrets in wp_options as plain text. Anyone with SQL access — which includes many backup plugins and migration tools — can read them. The Credentials Vault fixes this: every secret is encrypted at rest with AES-256-CBC before it's written, and only decrypted when a plugin asks for it through the Vault API.

Service groups

The Vault organizes credentials into service groups. Each group is a logical bundle — e.g., "Stripe" groups stripe.publishable_key, stripe.secret_key, stripe.webhook_secret. Adding a credential:

1. Go to Wigmorean Connect → Credentials
2. Pick a service group (Stripe, Brevo, Anthropic, etc.)
3. Enter the credential fields the group defines
4. Save — encrypted values land in wp_options, never plain text

Editing a credential

Click any group to expand it. Fields render with their values masked (•••••••). Click Edit to reveal and modify. Edits re-encrypt on save. No trace of the old value remains.

How plugins register with the Vault

Any plugin can register a service group via the wigmorean_credentials_services filter:

add_filter( 'wigmorean_credentials_services', function( $services ) {
    $services['my-service'] = [
        'label'  => 'My Service',
        'fields' => [
            'api_key'     => [ 'label' => 'API Key', 'required' => true ],
            'account_id'  => [ 'label' => 'Account ID' ],
        ],
    ];
    return $services;
} );

Plugin authors should always read through the Vault rather than reading wp_options directly:

$api_key = Wigmorean_Connect_Credentials::get( 'my-service.api_key' );

Encryption key management

The Vault's master key is stored in wp-config.php, not the database. On a fresh install, Connect generates a random key and writes it there; on existing installs, it uses whatever's already defined:

define( 'WIGMOREAN_CREDENTIALS_KEY', '...64 hex chars...' );

If the key is ever rotated, all vault entries must be re-encrypted — the Vault has a built-in rotation command.