{"id":320119,"date":"2026-06-05T16:22:18","date_gmt":"2026-06-05T16:22:18","guid":{"rendered":"https:\/\/ja.wordpress.org\/plugins\/connectvault\/"},"modified":"2026-06-06T11:54:40","modified_gmt":"2026-06-06T11:54:40","slug":"kagivault","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/kagivault\/","author":18440949,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.1.2","stable_tag":"0.1.2","tested":"7.0","requires":"7.0","requires_php":"8.3","requires_plugins":null,"header_name":"Kagivault","header_author":"Benridane","header_description":"Encrypts WordPress AI Connectors API keys at rest using XChaCha20-Poly1305 + Argon2id, with admin-side unlock.","assets_banners_color":"","last_updated":"2026-06-06 11:54:40","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/github.com\/benridane\/kagivault","header_author_uri":"https:\/\/benridane.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":54,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.1.1":{"tag":"0.1.1","author":"presents111","date":"2026-06-05 16:22:03"},"0.1.2":{"tag":"0.1.2","author":"presents111","date":"2026-06-06 11:54:40"}},"upgrade_notice":{"0.1.2":"<p>Documentation and project-link updates. No functional changes.<\/p>","0.1.1":"<p>Idle-lock timeout defaults to 1 hour and is now configurable via the <code>KAGIVAULT_IDLE_TIMEOUT<\/code> wp-config constant.<\/p>","0.1.0":"<p>Initial release of Kagivault.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3562553,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3562553,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.1.1","0.1.2"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[2353,265993,246286,259397,12167],"plugin_category":[],"plugin_contributors":[252320],"plugin_business_model":[],"class_list":["post-320119","plugin","type-plugin","status-publish","hentry","plugin_tags-ai","plugin_tags-ai-connectors","plugin_tags-api-keys","plugin_tags-connectors","plugin_tags-encryption","plugin_contributors-presents111","plugin_committers-presents111"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/kagivault\/assets\/icon-128x128.png?rev=3562553","icon_2x":"https:\/\/ps.w.org\/kagivault\/assets\/icon-256x256.png?rev=3562553","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Kagivault is an encrypted vault for the <strong>WordPress 7.0 AI Connectors API<\/strong>. Out of the box, WordPress stores the API keys you configure on <strong>Settings \u2192 Connectors<\/strong> (OpenAI, Anthropic, Google, OpenRouter, and any other AI provider registered with the AI Client) as plaintext rows in the <code>wp_options<\/code> table. Anyone with database access \u2014 backups, leaked dumps, host migration files \u2014 can read them.<\/p>\n\n<p>Kagivault wraps each AI Connectors key with <strong>XChaCha20-Poly1305 (authenticated encryption)<\/strong> and protects the data-encryption key with a <strong>vault password derived through Argon2id<\/strong>. The vault password is never persisted, and the vault automatically re-locks after a short, configurable idle timeout. Unlock from the admin UI, and the WordPress AI client transparently sees the decrypted keys \u2014 no other plugin changes required.<\/p>\n\n<h4>Highlights<\/h4>\n\n<ul>\n<li>Drop-in encryption for every AI Connectors provider (<code>connectors_ai_*_api_key<\/code> rows)<\/li>\n<li>Vault password unlock with idle-timeout auto-lock<\/li>\n<li>Recovery key as a parallel unlock path<\/li>\n<li>Optional: link a WordPress login password so signing in automatically unlocks the vault<\/li>\n<li>Easy-mode initialization \u2014 no separate vault password to remember if you just want one-click setup<\/li>\n<li>Transparent for the core WP AI client and the Connectors admin page<\/li>\n<li>Versioned blob format for future cipher upgrades<\/li>\n<\/ul>\n\n<h4>Requirements<\/h4>\n\n<ul>\n<li>WordPress 7.0 or newer (uses the Connectors API introduced in 7.0)<\/li>\n<li>PHP 8.3 or newer<\/li>\n<li>PHP sodium extension with <strong>XChaCha20-Poly1305 AEAD<\/strong> (<code>sodium_crypto_aead_xchacha20poly1305_ietf_encrypt<\/code>)<\/li>\n<li>PHP sodium extension with <strong>Argon2id<\/strong> (<code>SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13<\/code>, requires libsodium 1.0.13+)<\/li>\n<\/ul>\n\n<p>The bundled sodium extension shipped with PHP 8.3+ on most platforms (Debian\/Ubuntu <code>php-sodium<\/code>, RHEL <code>php-sodium<\/code>, Alpine <code>php-sodium<\/code>, Windows official builds) includes both capabilities. The plugin refuses to activate and surfaces a clear admin notice if either is unavailable.<\/p>\n\n<h3>Privacy Policy<\/h3>\n\n<p>Kagivault does NOT:<\/p>\n\n<ul>\n<li>Send any data to external servers<\/li>\n<li>Track users<\/li>\n<li>Use cookies for tracking<\/li>\n<li>Share data with third parties<\/li>\n<\/ul>\n\n<p>Kagivault DOES:<\/p>\n\n<ul>\n<li>Process and store encrypted API keys locally on your server (<code>wp_options<\/code>)<\/li>\n<li>Keep the data-encryption key only in a short-lived transient that expires after the configured idle timeout<\/li>\n<\/ul>\n\n<h3>Support<\/h3>\n\n<p>For support, bug reports, or feature requests:<\/p>\n\n<ul>\n<li>Website: https:\/\/github.com\/benridane\/kagivault<\/li>\n<\/ul>\n\n<h3>Development<\/h3>\n\n<p>Development happens on GitHub. Pull requests welcome!<\/p>\n\n<ul>\n<li>Follow WordPress coding standards<\/li>\n<li>All code must pass <code>wp plugin check kagivault<\/code><\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>kagivault<\/code> directory to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> menu in WordPress. If sodium or Argon2id is missing, activation aborts with a specific message listing what is missing.<\/li>\n<li>Visit <strong>Settings \u2192 Kagivault<\/strong> and set a vault password. Store the recovery key shown to you - it cannot be recovered later.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"what%20happens%20to%20my%20ai%20keys%20while%20the%20vault%20is%20locked%3F\"><h3>What happens to my AI keys while the vault is locked?<\/h3><\/dt>\n<dd><p>They cannot be decrypted, so AI calls that rely on those keys will not have a key available for that request. Unlock the vault from <strong>Settings \u2192 Kagivault<\/strong> to restore functionality.<\/p><\/dd>\n<dt id=\"where%20is%20the%20vault%20password%20stored%3F\"><h3>Where is the vault password stored?<\/h3><\/dt>\n<dd><p>Nowhere. It is held only in browser memory long enough to unlock the vault. The derived data-encryption key lives in a short-lived transient that expires after the configured idle timeout.<\/p><\/dd>\n<dt id=\"does%20it%20cover%20keys%20defined%20in%20wp-config.php%3F\"><h3>Does it cover keys defined in wp-config.php?<\/h3><\/dt>\n<dd><p>Not in this release. Constants and environment variables still take precedence over the encrypted database entries, as defined by core. A later release will add a migration path.<\/p><\/dd>\n<dt id=\"can%20i%20change%20the%20idle-lock%20timeout%3F\"><h3>Can I change the idle-lock timeout?<\/h3><\/dt>\n<dd><p>Yes. Kagivault auto-locks after one hour of inactivity by default. Override per environment by defining the constant in <code>wp-config.php<\/code>:<\/p>\n\n<pre><code>define( 'KAGIVAULT_IDLE_TIMEOUT', 1800 ); \/\/ seconds\n<\/code><\/pre>\n\n<p>The constant always wins over the database setting. Values below 60 seconds are clamped to 60.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>0.1.2<\/h4>\n\n<ul>\n<li>Updated the plugin and support links to point to the GitHub repository.<\/li>\n<li>Clarified the readme and admin UI wording describing how the vault locks and unlocks.<\/li>\n<\/ul>\n\n<h4>0.1.1<\/h4>\n\n<ul>\n<li>Default idle-lock timeout extended from 30 minutes to 1 hour.<\/li>\n<li>Added <code>KAGIVAULT_IDLE_TIMEOUT<\/code> constant so the timeout can be overridden from <code>wp-config.php<\/code> (takes precedence over the database setting).<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>Initial release: encrypted storage for WordPress AI Connectors API keys (OpenAI, Anthropic, Google, OpenRouter, ...), vault-password unlock with idle auto-lock, recovery key, and optional WP login-password auto-unlock.<\/li>\n<\/ul>","raw_excerpt":"Encrypts WordPress AI Connectors API keys (OpenAI, Anthropic, Google, OpenRouter) at rest with XChaCha20-Poly1305 + Argon2id.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/320119","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=320119"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/presents111"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=320119"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=320119"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=320119"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=320119"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=320119"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=320119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}