Secrets vault Pro

Pro · This feature is part of Snipfire Pro. Plans

A snippet that talks to Stripe, Mailchimp or a shipping company needs an API key. Pasted into the code, that key ends up in every export, every Git commit, the history, a screenshot for a colleague. The secrets vault keeps it out of the code: you store the key once, encrypted, and your PHP snippet asks for it by name.

Add a secret #

1. In the editor, click Secrets at the bottom of the sidebar.
2. Under Add a secret, type a Name (lowercase letters, digits and underscores, for example stripe_key) and the Value.
3. Click Add secret.

Once saved, a value is never shown again, not even to you. The list shows each secret's name, a masked hint (the last four characters, for values of 12 characters or more), when it was updated and last used, and which snippets use it. Replace value saves a new value; Delete removes the secret (snippets that read it get nothing from then on).

A value can be up to 64 KB.

Use it in a PHP snippet #

$key = function_exists( 'snipfire_secret' ) ? snipfire_secret( 'stripe_key' ) : null;
if ( $key ) {
    $response = wp_remote_get( 'https://api.stripe.com/v1/balance', array(
        'headers' => array( 'Authorization' => 'Bearer ' . $key ),
    ) );
}

snipfire_secret( 'name' ) returns the value as a string, or null if there's no such secret or it can't be decrypted.

Guard it with function_exists(), as above. The function only exists while Snipfire Pro is active with a licence; without the check, a snippet that calls it would fail when Pro is off.

Only in PHP snippets. In an HTML snippet snipfire_secret() gives null, and CSS and JavaScript can't call it: printing a secret into a page would show it to every visitor. Saving warns you if a snippet that isn't PHP uses it, or if it asks for a secret that doesn't exist or can't be decrypted. The list of secrets flags those too, under Used but missing.

Where secrets never appear #

The vault keeps values out of everything that leaves the site or shows on a screen:

• the editor and the REST API (names, dates and the masked hint only),
• exports, Git sync files and exported plugins,
• the snippet's history,
• the activity log (Secret: stripe_key added, never the value),
• error messages Snipfire records or logs: a secret's value in an error is replaced with [secret:name],
• WP-CLI output (there's no command that prints a value),
• system info,
• what the AI assistant sends, even if a value was pasted into the code.

What the vault doesn't protect against #

The vault protects against accidental exposure. It can't stop someone who can write PHP snippets on your site: they can read any secret by writing code that prints it. That's why only people with full access can write PHP.

One more limit: PHP itself writes uncaught exceptions to the server's error log with their message. If your snippet throws an exception whose message contains the secret, PHP's log line has it. Snipfire's own messages are redacted.

The encryption key #

Secrets are encrypted with libsodium (XChaCha20-Poly1305), with a key from one of two places. Encryption key at the top of the Secrets view says which.

• Your site's salts (the default): a key made from SECURE_AUTH_KEY and SECURE_AUTH_SALT in wp-config.php. Nothing to set up. But if the salts change (some security plugins and hosts change them, for example after a hack), saved secrets can't be decrypted any more and have to be entered again.

• A key of its own: add SNIPFIRE_SECRETS_KEY to wp-config.php. Generate a key line makes one in your browser (it isn't sent anywhere) to paste in:

  define( 'SNIPFIRE_SECRETS_KEY', 'at least 32 random characters' );
  

  Then click Re-encrypt to move the existing secrets to the new key. Until you do, they stay readable with the old key and the view says how many still use the previous key. A key shorter than 32 characters gets a warning.

When a secret can't be decrypted, the view says why: the key changed (the salts or SNIPFIRE_SECRETS_KEY), the key it was saved with is gone (was SNIPFIRE_SECRETS_KEY removed?), or the stored value was damaged. Enter the value again.

Keep SNIPFIRE_SECRETS_KEY out of Git and backups you share, like the rest of wp-config.php. The same key protects the agency hub's application passwords.

Who can use the vault #

Administrators with full Snipfire access (super admins on multisite). Team access can't give anyone else the vault, even with Full access.

On multisite each site has its own vault. Network snippets read the vault of the site they're running on.

Without Snipfire Pro #

The secrets stay stored, encrypted, but snipfire_secret() doesn't exist, so guarded snippets get null. Deleting Snipfire Pro keeps the secrets (so reinstalling it doesn't lose them) unless SNIPFIRE_DELETE_DATA is set.

From the command line #

wp snipfire secret list                       # names, hints, dates, where used; never the values
printf %s "$STRIPE_KEY" | wp snipfire secret set stripe_key
wp snipfire secret set stripe_key             # asks for the value, hidden
wp snipfire secret delete stripe_key --yes
wp snipfire secret rekey                      # re-encrypt with the current key

set reads the value from standard input. --value= works too, but leaves the value in your shell history. See WP-CLI.