Keeping API Keys Out of the Database

Keeping API Keys Out of the Database

The settings screen lets you paste a key and save it. That works, and for a personal site it is fine. For anything you hand to a client, migrate between environments, or back up off-site, put the key in wp-config.php instead.

The two constants

define( 'AI_FQ_OPENAI_KEY', 'sk-…' );
define( 'AI_FQ_HF_TOKEN', 'hf_…' );

Add either near the top of wp-config.php, above the /* That's all, stop editing! */ line.

Ollama has no constant, because it has no credential.

What changes when a constant is set

The constant wins. The plugin reads it first and only falls back to the saved option when the constant is undefined or empty.

The settings screen detects it and shows:

Defined via AI_FQ_OPENAI_KEY in wp-config.php. The field below is ignored.

The field stays visible but has no effect. If a key was previously saved to the database it is still sitting there, unused — worth clearing with the field's tick-box if you no longer want it stored.

Why this is worth the two minutes

A key in the options table is a key in:

• every wp db export and every automated backup
• every staging or development copy pulled from production
• every migration handed to another agency
• the reach of anyone with database access but not server access

A key in wp-config.php is in none of those, assuming your backups exclude it or are handled separately. It also means the credential is not editable by anyone who can reach /wp-admin but not the filesystem.

Rotating a key

With a constant, rotation is a one-line edit: change the value in wp-config.php. Nothing in WordPress caches it.

If you are moving from a saved key to a constant:

1. Add the constant with the new key.
2. Confirm the settings screen shows the "defined via" notice.
3. Tick the clear checkbox next to the credential field and save, to remove the stale value from the database.

The three status labels

Label	Meaning
Defined via … in wp-config.php. The field below is ignored.	A constant is set and in use
Saved, not in use	A credential is stored for a provider you have not selected
Unsaved changes / All changes saved	Whether the form differs from what is stored

"Saved, not in use" is not an error. It means, for example, that you have an OpenAI key stored but Ollama selected. Harmless, but if you have finished experimenting it is tidier to clear it.

How the key fields behave

Three behaviours that are deliberate and often surprise people:

• They always render empty. A saved key is never printed back into the page. Empty does not mean absent.
• Saving with the field blank keeps the existing value. This is how you edit the model without re-pasting the key.
• Removing a key requires the tick-box. Blanking the field does nothing; tick the clear checkbox and save.

One thing to check in production

Provider error messages are written to the PHP error log when WP_DEBUG is enabled. Those messages come from the upstream service and can contain request detail. Keep WP_DEBUG off in production — the plugin never shows upstream errors to visitors, but debug logging is a separate path.