Secrets API & credential storage
WordPress 7.2 introduces a Secrets API, with WP-CLI support, so plugins can store API keys and other credentials with native libsodium encryption instead of plain-text options.
Dedicated call for testing Proposal: A Secrets API for WordPress 7.2
Testing steps
- Go to Tools → Site Health. Check the Secrets API tests on the Status tab and the encryption details on the Info tab.
- Register and retrieve credentials with the Secrets API helper functions in test code, or via WP-CLI.
- Confirm stored credentials are encrypted in the database and never exposed in plain text.
- Confirm secret values are omitted or redacted from REST API responses, debug logs, Site Health info, and XML exports.
- Make invalid credential calls and confirm they fail gracefully without fatal errors.
Expected
Secrets are registered, stored securely, and retrievable only through authorized API methods, without leaking into logs or exports.
Issues? Report feedback Track Trac #66187