Connectors: Add API key source detection and refactor REST dispatch by jorgefilipecosta · Pull Request #11228 · WordPress/wordpress-develop

jorgefilipecosta · 2026-03-11T17:55:29Z

Summary

Trac ticket: https://core.trac.wordpress.org/ticket/64819

Backports two Gutenberg PRs into WordPress core:

Gutenberg #76266 — Adds _wp_connectors_get_api_key_source() to detect whether an API key is configured via environment variable, PHP constant, or database. The UI uses this to show the key source and hide "Remove and replace" for externally configured keys.
Gutenberg #76327 — Refactors API key validation and masking from sanitize_callback + option_ filters into a single rest_post_dispatch handler (_wp_connectors_rest_settings_dispatch), ensuring raw keys are never exposed via REST API responses.

Changes

New function: _wp_connectors_get_api_key_source() — checks env var → PHP constant → database for API key origin
New function: _wp_connectors_rest_settings_dispatch() — masks keys in all /wp/v2/settings responses and validates on POST/PUT, reverting invalid keys
Removed function: _wp_connectors_get_real_api_key() — no longer needed since masking moved out of option filters
Removed function: _wp_connectors_validate_keys_in_rest() — replaced by the new dispatch handler
Modified: _wp_connectors_get_connector_settings() — added static memoization and plugin is_installed/is_activated status enrichment
Modified: _wp_register_default_connector_settings() — simplified sanitize_callback to sanitize_text_field, removed option mask filter
Modified: _wp_connectors_pass_default_keys_to_ai_client() — skips keys from env/constant sources, uses get_option() directly
Modified: _wp_connectors_get_connector_script_module_data() — exposes keySource, isConnected, logoUrl, and plugin status (isInstalled, isActivated)

Test plan

Verify connectors admin screen loads and displays connector data correctly
Test saving a valid API key via the settings REST endpoint — key should be masked in the response
Test saving an invalid API key — key should be reverted to empty
Verify env var and constant-sourced keys are detected and shown with correct source
Run phpunit --group connectors to verify existing tests pass

github-actions · 2026-03-11T17:55:40Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props jorgefilipecosta, gziolo.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-03-11T17:59:42Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

gziolo · 2026-03-11T22:31:20Z

It would be nice to commit #11227 first and rebase this branch. Alternatively, this can land first but we should ensure the approach taken is compatible with the function removal.

Add `_wp_connectors_get_api_key_source()` to detect whether an API key comes from an environment variable, PHP constant, or the database. This enables the UI to show the key source and hide the remove button for externally configured keys. Refactor API key validation and masking from `sanitize_callback` and `option_` filters into a single `rest_post_dispatch` handler (`_wp_connectors_rest_settings_dispatch`). This ensures raw keys are never exposed via the REST API and simplifies the validation flow. Enrich `_wp_connectors_get_connector_settings()` with plugin installation/activation status and static memoization. Update `_wp_connectors_get_connector_script_module_data()` to expose `keySource`, `isConnected`, `logoUrl`, and plugin status to the admin. Backports WordPress/gutenberg#76266 Backports WordPress/gutenberg#76327 updates include ref update

src/wp-includes/connectors.php

Add `_wp_connectors_get_api_key_source()` to detect whether an API key comes from an environment variable, PHP constant, or the database. This enables the UI to show the key source and hide the remove button for externally configured keys. Refactor API key validation and masking from `sanitize_callback` and `option_` filters into a single `rest_post_dispatch` handler (`_wp_connectors_rest_settings_dispatch`). This ensures raw keys are never exposed via the REST API and simplifies the validation flow. Enrich `_wp_connectors_get_connector_settings()` with plugin installation/activation status and static memoization. Update `_wp_connectors_get_connector_script_module_data()` to expose `keySource`, `isConnected`, `logoUrl`, and plugin status to the admin. Backports WordPress/gutenberg#76266 Backports WordPress/gutenberg#76327 updates include ref update # Conflicts: # src/wp-includes/connectors.php

gziolo · 2026-03-12T10:37:32Z

src/wp-includes/connectors.php

 	foreach ( wp_get_connectors() as $connector_id => $connector_data ) {
 		$auth = $connector_data['authentication'];
-		if ( 'ai_provider' !== $connector_data['type'] || 'api_key' !== $auth['method'] || empty( $auth['setting_name'] ) ) {
+		if ( 'api_key' !== $auth['method'] || empty( $auth['setting_name'] ) ) {


The old _wp_connectors_validate_keys_in_rest also checked 'ai_provider' \!== $connector_data['type'] here, but this was dropped. Currently all connectors with api_key auth are ai_provider type, so it's functionally equivalent today — but it broadens scope for any future connector types that might use api_key auth. Was this intentional?

src/wp-includes/connectors.php

gziolo

Everything works as expected.

github-actions · 2026-03-12T12:06:16Z

A commit was made that fixes the Trac ticket referenced in the description of this pull request.

SVN changeset: 61985
GitHub commit: a47dc58

This PR will be closed, but please confirm the accuracy of this and reopen if there is more work to be done.

jorgefilipecosta force-pushed the connectors-api-key-source-and-rest-dispatch branch 2 times, most recently from 69aa0de to ee1559e Compare March 11, 2026 22:24

jorgefilipecosta mentioned this pull request Mar 11, 2026

Test connectors #11231

Closed

desrosj force-pushed the connectors-api-key-source-and-rest-dispatch branch from bbd8e8f to 9379b18 Compare March 12, 2026 04:49

jorgefilipecosta force-pushed the connectors-api-key-source-and-rest-dispatch branch from 9379b18 to 45189ca Compare March 12, 2026 10:15

gziolo reviewed Mar 12, 2026

View reviewed changes

src/wp-includes/connectors.php Outdated Show resolved Hide resolved

gziolo requested a review from swissspidy March 12, 2026 10:24

gziolo reviewed Mar 12, 2026

View reviewed changes

src/wp-includes/connectors.php Outdated Show resolved Hide resolved

gziolo approved these changes Mar 12, 2026

View reviewed changes

jorgefilipecosta added 2 commits March 12, 2026 11:28

review feedback

54bd359

filter prioerity change

82c9811

github-actions bot closed this Mar 12, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Connectors: Add API key source detection and refactor REST dispatch#11228

Connectors: Add API key source detection and refactor REST dispatch#11228
jorgefilipecosta wants to merge 4 commits intoWordPress:trunkfrom
jorgefilipecosta:connectors-api-key-source-and-rest-dispatch

jorgefilipecosta commented Mar 11, 2026 •

edited by gziolo

Loading

Uh oh!

github-actions bot commented Mar 11, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

gziolo commented Mar 11, 2026

Uh oh!

Uh oh!

gziolo Mar 12, 2026

Uh oh!

jorgefilipecosta Mar 12, 2026

Uh oh!

Uh oh!

gziolo left a comment

Uh oh!

github-actions bot commented Mar 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jorgefilipecosta commented Mar 11, 2026 • edited by gziolo Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Test plan

Uh oh!

github-actions bot commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 11, 2026

Test using WordPress Playground

Some things to be aware of

Uh oh!

gziolo commented Mar 11, 2026

Uh oh!

Uh oh!

gziolo Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

jorgefilipecosta Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gziolo left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jorgefilipecosta commented Mar 11, 2026 •

edited by gziolo

Loading

github-actions bot commented Mar 11, 2026 •

edited

Loading