lightsyncpro

tagteamdesign

WordPress stores API keys in your database in plain text by default. If your database is compromised through SQL injection, a backup leak, or a vulnerable plugin, every API key is exposed. WordPress 7.0’s new Connectors API stores AI provider keys the same way (core ticket #64789).
Syncific Vault fixes this. Your API keys are moved to an encrypted vault hosted off-site. Your WordPress database stores only a reference — the real key is injected at request time and never persists locally.
One vault for all your AI plugins. Store your API keys in Syncific Vault — not in your database. Paste the secure placeholder into AI Engine, ClassifAI, Elementor AI, or any plugin that needs it. When you rotate a key with your provider, update it once in Syncific Vault — every plugin gets the new key instantly.
<h4>How it works</h4>
<ol>
<li>Paste your API key in the Syncific Vault settings page</li>
<li>The key is encrypted and sent to the Syncific Vault (AES-256, never in your database)</li>
<li>A secure placeholder key is generated — paste it into your other plugins’ settings</li>
<li>When any plugin makes an API call, Syncific Vault intercepts it and injects the real key</li>
<li>Other plugins work normally — they don’t know the key was swapped</li>
<li>If your database is dumped or compromised, no API keys are exposed</li>
</ol>
<h4>Supports any AI API key</h4>
<ul>
<li>AI providers: OpenAI, Anthropic, Google AI, OpenRouter</li>
<li>Any API that uses header-based authentication (custom domain support included)</li>
</ul>
<h4>Security</h4>
<ul>
<li>Keys encrypted with AES-256 in an isolated vault file — not a database</li>
<li>Vault file stored outside the web root with strict file permissions</li>
<li>Patent-pending broker architecture (US App. No. 19/440,404)</li>
<li>Keys never stored in wp_options, wp_postmeta, or any WordPress table</li>
<li>In-memory key retrieval only — credentials are not persisted in any WordPress storage layer (database, transients, or options)</li>
<li>One-click key rotation — update a key once, every plugin gets the new key instantly</li>
<li>Rate-limited vault access (60 requests/minute per site)</li>
<li>Fails open by design — vault outages never break your WordPress site, though AI features dependent on protected keys will fail authentication until the vault is reachable again</li>
</ul>
<h4>Protects against</h4>
<ul>
<li>Database dumps and backup file exposure</li>
<li>SQL injection attacks</li>
<li>Compromised plugins that read wp_options</li>
<li>Unauthorized phpMyAdmin or database client access</li>
<li>Hosting provider data breaches</li>
</ul>
<h4>External Service</h4>
This plugin relies on the Syncific Vault API, an external broker service operated by <a href="https://syncific.com" rel="nofollow ugc">Syncific</a>, to store and retrieve encrypted API keys. All requests are sent to the broker endpoint at <code>https://lightsyncpro.com/wp-json/lsp-broker/v1/</code> — the broker host that Syncific operates for this service.
What the service does: Syncific Vault provides encrypted off-site storage for API keys. Keys are encrypted with AES-256 and stored in an isolated vault file on the Syncific broker server (<code>lightsyncpro.com</code>) — not in your WordPress database.
What data is sent and when:
<ul>
<li>When you store a key: Your site URL, a hash of your site URL, a per-site authentication token, a single-use verification nonce, the API domain, the API key, a label, and the authentication header name are sent to the broker (<code>lightsyncpro.com</code>) via HTTPS. The broker then calls your site back once at <code>/wp-json/svault/v1/verify</code> to confirm site ownership before binding the key.</li>
<li>When a plugin makes an API call to a protected domain: Your site URL hash, per-site token, and the API domain are sent to the broker (<code>lightsyncpro.com</code>) to retrieve the real key. The key is held in PHP memory only for the duration of the request and is never written to your database.</li>
<li>When you remove a key (or uninstall the plugin): Your site URL hash, per-site token, and the API domain are sent to the broker (<code>lightsyncpro.com</code>) to remove the key from the vault.</li>
</ul>
No other user data, site content, or visitor information is ever transmitted.
Service links:
<ul>
<li><a href="https://syncific.com/terms.html" rel="nofollow ugc">Syncific Terms of Service</a></li>
<li><a href="https://syncific.com/privacy.html" rel="nofollow ugc">Syncific Privacy Policy</a></li>
</ul>
<h4>Supported AI Providers</h4>
Syncific Vault includes preset support for the following AI provider APIs. This plugin does not connect to these services directly. They are the destination domains whose API keys are protected by Vault. When another plugin on your site makes a request to one of these domains, Syncific Vault intercepts the request and injects the protected key. The traffic to these providers originates from your other plugins (such as AI Engine, ClassifAI, or any plugin you’ve configured), not from Syncific Vault itself.
<ul>
<li>OpenAI (api.openai.com) — <a href="https://openai.com/policies/terms-of-use" rel="nofollow ugc">Terms of Use</a> | <a href="https://openai.com/policies/privacy-policy" rel="nofollow ugc">Privacy Policy</a></li>
<li>Anthropic (api.anthropic.com) — <a href="https://www.anthropic.com/legal/consumer-terms" rel="nofollow ugc">Consumer Terms</a> | <a href="https://www.anthropic.com/legal/privacy" rel="nofollow ugc">Privacy Policy</a></li>
<li>Google AI / Gemini (generativelanguage.googleapis.com) — <a href="https://ai.google.dev/gemini-api/terms" rel="nofollow ugc">API Terms</a> | <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a></li>
<li>OpenRouter (openrouter.ai) — <a href="https://openrouter.ai/terms" rel="nofollow ugc">Terms</a> | <a href="https://openrouter.ai/privacy" rel="nofollow ugc">Privacy</a></li>
</ul>
You may also add any other domain through the “Add Custom Domain” option in the plugin settings. Whatever domain you add becomes a protected destination — your other plugins continue to send requests to that domain as they normally would, and Syncific Vault transparently provides the credentials.
<h4>Free and open source</h4>
Syncific Vault is completely free. No limits on the number of keys you can protect.
<h4>Made by Syncific</h4>
Syncific Vault is built by the team behind <a href="https://syncific.com" rel="nofollow ugc">Syncific</a> — the creative asset sync platform. The same patent-pending broker architecture that protects OAuth credentials for Lightroom, Figma, Canva, and Dropbox now protects your API keys.

Syncific Vault — API Key Protection & Security

Encrypt your AI API keys and keep them out of the WordPress database — one secure vault for WordPress 7.0 Connectors and every AI plugin.

Ekatra Global Corp

Ekatra transforms solo shopping into real-time, collaborative commerce. Shoppers invite friends to co-explore the store, Co-discover & co-view products, & validating each others choice co-decide & ultimately Co-shop while chatting or video calling. Each shopper checks out independently. This boosts engagement, trust, & conversions, just like in-store shopping, but fully digital. A plug-and-play layer that turns your store into a social experience. A complete organic growth engine for e-commerce.
<h3>Key Features:</h3>
Shoppers Benefits
<ul>
<li>Enables your store to your shoppers to invite friends to shop together from anywhere, as if they do at real physical store.</li>
<li>Co-discover Co-View & discuss the same product simultaneously while chatting/video-chatting</li>
<li>Safe & Secure: No Screen/Device Share during chat/video-call yet multi-control.</li>
<li>Organically grow branding reach by shoppers friends, a natural Network Effect + Scales Engagement + White Label = Lower CAC + More Conversions + Durable CLTV.</li>
</ul>
Key Onboarding Steps
<ul>
<li>Generate REST API keys (Consumer Key & Secret) for authenticated integration with external services.</li>
<li>Redirect store owners to the Ekatra dashboard for signup and onboarding.</li>
<li>Save and manage keys via WooCommerce and WordPress APIs.</li>
<li>Add a Shop Together button to product pages using the <code>tg_url</code> meta key.</li>
<li>Support for button design customization via themes.</li>
<li>Support shared cart redirection via <code>/custom-add-to-cart?items=...</code> endpoint.</li>
<li>Register custom cart endpoint to programmatically add multiple items to cart via URL.</li>
<li>Webhook support for product sync on create/update/delete.</li>
<li>Activation and deactivation hooks for setup and cleanup.</li>
</ul>
⚠️ Note: This plugin integrates with the Ekatra platform, which offers free trial. Continued use after the trial requires a paid subscription. The plugin itself is free and open-source.
<h3>Privacy</h3>
This plugin does not track users or share data with external systems without user consent. For integrations, store owners must explicitly authorize data sharing by registering on the Ekatra dashboard.
<h3>License</h3>
This plugin is free software. It is released under the GPLv2 or later license.
<h3>Data Usage & Privacy</h3>
This plugin collects and transfers the WooCommerce REST API key and secret only after user authorization during the onboarding process.
<ul>
<li>The credentials are securely transferred to Ekatra’s backend via HTTPS.</li>
<li>They are temporarily stored in Redis, then persisted to a secured database.</li>
<li>The temporary Redis cache is deleted immediately after storing the credentials.</li>
<li>No customer or order data is collected, tracked, or transmitted unless explicitly initiated via the Ekatra dashboard.</li>
</ul>
All data handling practices comply with WooCommerce extension guidelines and standard data privacy policies.
<h3>External Services</h3>
This plugin communicates with the following external services:
<ol>
<li>
https://seller.ekatraglobal.com/api/woo/webhook
<ul>
<li>Purpose: Receives WooCommerce webhook events (product created, updated, deleted). </li>
<li>Data sent: product data, custom fields as per WooCommerce webhook configuration. </li>
<li>When: During plugin activation, webhook is registered and starts forwarding product changes. </li>
<li>Service provided by: Ekatra Global Corp. </li>
</ul>
</li>
<li>
https://seller.ekatraglobal.com/api/woo/key
<ul>
<li>Purpose: Sends the WooCommerce store URL, API consumer key, and consumer secret to the Ekatra backend. </li>
<li>Data sent: Store URL, API consumer key and secret. </li>
<li>When: When the user clicks “Redirect to Dashboard” after generating API keys. </li>
<li>Service provided by: Ekatra Global Corp. </li>
</ul>
</li>
<li>
https://seller.ekatraglobal.com/api/woo/uninstall
<ul>
<li>Purpose: Notifies Ekatra when the plugin is uninstalled. </li>
<li>Data sent: WooCommerce store URL. </li>
<li>When: During plugin uninstallation. </li>
<li>Service provided by: Ekatra Global Corp.</li>
</ul>
</li>
</ol>
<h3>Terms of Service and Privacy Policy for Ekatra</h3>
<ul>
<li>https://ekatraglobal.com/terms-and-conditions</li>
<li>https://ekatraglobal.com/privacy-policy</li>
</ul>
<h3>How This Plugin Communicates with Ekatra</h3>
Webhook Setup on Activation 
When the plugin is activated, it automatically registers a WooCommerce webhook with the URL https://seller.ekatraglobal.com/api/woo/webhook. This allows Ekatra to receive product lifecycle events — such as when a product is created, updated, or deleted — so that the co-shopping functionality remains in sync with the store catalog.
API Key Transfer on Dashboard Redirect 
After generating the WooCommerce REST API credentials, users can click the “Redirect to Dashboard” button. This triggers a secure call to https://seller.ekatraglobal.com/api/woo/key, which sends the store URL, consumer key, and secret. Ekatra uses these credentials to access product data, generate “Shop Together” links, and update product custom fields accordingly.
Notification on Plugin Uninstallation 
When the plugin is uninstalled, it calls https://seller.ekatraglobal.com/api/woo/uninstall, sending only the store URL. This allows the Ekatra backend to clean up or mark the store as disconnected, ensuring user data and connection status remain up to date.
Custom Cart Endpoint for Shared Cart Redirection 
The plugin registers a custom endpoint at /custom-add-to-cart, allowing users to add multiple products to the WooCommerce cart via a structured URL. This endpoint powers Ekatra’s shared cart experience, making it easy for co-shoppers to participate in a group session from any device or browser.
1.Example URL: 
 – /custom-add-to-cart?items=[{“id”:123,”quantity”:2},{“id”:456,”quantity”:1,”attr”:{“pa_color”:”red”,”pa_size”:”medium”}}]
2.Purpose: Enables users to open a cart with pre-filled products and variations shared during a co-shopping session.
3.Data handled: Only product IDs, quantities, and optional variation attributes (e.g., color, size).
4.When used: When a user joins or resumes a session from the Ekatra dashboard.
<h3>Privacy and Checkout Information</h3>
1.Each participant adds their own selected items to their individual cart.
2.Users checkout only their own cart — there is no shared payment or billing process.
3.The entire checkout flow, including billing, shipping, and payment, is securely handled by the WooCommerce store.
4.Ekatra does not access, store, or process any personal customer data or payment information.
This design ensures full privacy and security while enabling collaborative shopping through cart sharing — with complete control remaining within the WooCommerce store.
<h3>Contributors & Developers</h3>
These services are hosted by the plugin developer (Ekatra Global Corp).

Ekatra Co-Shopping

Extend WooCommerce with collaborative shopping. Connect with Ekatra, generate API keys, and add a “Shop Together” button to product pages.

Syncific Vault — API Key Protection & Security vs Ekatra Co-Shopping