Encrypts WordPress AI Connectors API keys (OpenAI, Anthropic, Google, OpenRouter) at rest with XChaCha20-Poly1305 + Argon2id.

miya

<p>Kagivault is an encrypted vault for the <strong>WordPress 7.0 AI Connectors API</strong>. Out of the box, WordPress stores the API keys you configure on <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Connectors</strong> (OpenAI, Anthropic, Google, OpenRouter, and any other AI provider registered with the AI Client) as plaintext rows in the <code>wp_options</code> table. Anyone with database access — backups, leaked dumps, host migration files — can read them.</p>
<p>Kagivault wraps each AI Connectors key with <strong>XChaCha20-Poly1305 (authenticated encryption)</strong> and protects the data-encryption key with a <strong>vault password derived through Argon2id</strong>. The vault password is never persisted, and the vault automatically re-locks after a short, configurable idle timeout. Unlock from the admin UI, and the WordPress AI client transparently sees the decrypted keys — no other plugin changes required.</p>
<h4>Highlights</h4>
<ul>
<li>Drop-in encryption for every AI Connectors provider (<code>connectors_ai_*_api_key</code> rows)</li>
<li>Vault password unlock with idle-timeout auto-lock</li>
<li>Recovery key as a parallel unlock path</li>
<li>Optional: link a WordPress login password so signing in automatically unlocks the vault</li>
<li>Easy-mode initialization — no separate vault password to remember if you just want one-click setup</li>
<li>Transparent for the core WP AI client and the Connectors admin page</li>
<li>Versioned blob format for future cipher upgrades</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>WordPress 7.0 or newer (uses the Connectors API introduced in 7.0)</li>
<li>PHP 8.3 or newer</li>
<li>PHP sodium extension with <strong>XChaCha20-Poly1305 AEAD</strong> (<code>sodium_crypto_aead_xchacha20poly1305_ietf_encrypt</code>)</li>
<li>PHP sodium extension with <strong>Argon2id</strong> (<code>SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13</code>, requires libsodium 1.0.13+)</li>
</ul>
<p>The bundled sodium extension shipped with PHP 8.3+ on most platforms (Debian/Ubuntu <code>php-sodium</code>, RHEL <code>php-sodium</code>, Alpine <code>php-sodium</code>, Windows official builds) includes both capabilities. The plugin refuses to activate and surfaces a clear admin notice if either is unavailable.</p>
<h3>Privacy Policy</h3>
<p>Kagivault does NOT:</p>
<ul>
<li>Send any data to external servers</li>
<li>Track users</li>
<li>Use cookies for tracking</li>
<li>Share data with third parties</li>
</ul>
<p>Kagivault DOES:</p>
<ul>
<li>Process and store encrypted API keys locally on your server (<code>wp_options</code>)</li>
<li>Keep the data-encryption key only in a short-lived transient that expires after the configured idle timeout</li>
</ul>
<h3>Support</h3>
<p>For support, bug reports, or feature requests:</p>
<ul>
<li>Website: https://github.com/benridane/kagivault</li>
</ul>
<h3>Development</h3>
<p>Development happens on GitHub. Pull requests welcome!</p>
<ul>
<li>Follow WordPress coding standards</li>
<li>All code must pass <code>wp plugin check kagivault</code></li>
</ul>


Alternatives to Kagivault

Top alternatives