An API key authorizes AI Webmaster to send an administrator-triggered request to a supported external AI provider, such as OpenAI. This guide explains how to obtain and configure a user-owned key, protect it, understand what data may be sent, verify the connection, rotate or revoke the key, and resolve common API errors.
Understand API keys before using AI Webmaster features
What is an API key?
An API key is a secret credential that authenticates requests from your WordPress site to an external service, such as the OpenAI API. Treat it like a password. It authorizes requests under the provider account associated with the key, so never publish it, expose it in browser code, include it in screenshots or repositories, or share it with support.
Why does AI Webmaster use your own API key?
- You control the connected AI provider account
- Usage, quota, and billing remain visible in your provider account
- You can revoke or replace the key through the provider dashboard
- AI Webmaster does not provide or resell a shared provider account; requests and related usage remain connected to your provider account
When is an API key required?
- AI-assisted page and post creation
- Content improvement and analysis
- Website structure and internal linking suggestions
- Any enabled AI feature that sends a request to an external provider
How to configure an API key in WordPress
- Create or sign in to your OpenAI account, or use another provider only if your installed AI Webmaster version explicitly supports it. Review the provider’s current account, API access, billing, data-use, and security requirements before creating a key.
- Open the API key section of your provider account.
- Generate a new secret API key and copy it once to a secure location. Providers may not show the complete key again.
- In WordPress, open AI Webmaster → Settings.
- Paste the key into the OpenAI API Key field, if that field is available in your installed version.
- Save the settings, then use the connection or validation tool included in your installed version. A successful test does not replace normal usage and security checks.
How is my API key stored?
The key is stored with the plugin settings in your WordPress installation. An API key is separate from a WordPress administrator account: it authorizes requests to the connected provider, while WordPress roles control access to your website. The protection of the saved value also depends on your hosting, administrator access, backups, server controls, and the installed plugin’s implementation. Limit access to trusted administrators, protect WordPress and hosting access, and never share or publish the key.
Security and best practices
Protect your API key
- Never post or commit your API key to a public website, repository, screenshot, or support request
- Do not place the key in theme files, client-side code, public repositories, or shared documents
- Restrict WordPress administrator access to trusted users and use strong account security
- Revoke an exposed key immediately, create a replacement, and update the plugin settings
What data may be sent to an external AI provider?
- Prompts, instructions, and task settings included in the administrator-triggered request
- The content or metadata selected for the requested task
- Relevant website structure or linking context when required by the task
- Only the data included in or required by the administrator-triggered AI request; the exact handling and retention of that data are governed by the provider’s current terms and policies
Review every request before sending it. Never submit passwords, private API keys, administrator credentials, database dumps, confidential customer data, or other sensitive information. Send only the content and context necessary for the administrator-approved task. The provider’s current terms, privacy documentation, and data-use policies govern its handling of submitted data.
Provider costs, quota, and usage
- AI Webmaster does not set or control external provider pricing
- Monitor usage, quota, billing, and account activity in your provider dashboard
- If a request fails, check both the plugin settings and the provider account status
Troubleshooting API key and provider errors
No API key detected
- Confirm that the key is entered in the correct field and that the settings were saved
- Re-enter the key carefully without additional spaces, then save the settings again
- Run the plugin’s connection test or validation tool included in your installed version
Invalid, revoked, or expired key
- Check the provider dashboard and create a new key if the existing key is invalid, revoked, or no longer available
- Replace the old value in WordPress and save the settings
- Test the connection using the option included in your installed version
Quota, billing, permission, rate-limit, timeout, and model errors
- Check the provider account’s quota, billing status, model access, permissions, rate limits, and service status
- Confirm that API access and the selected model are available for the connected account, and verify that the request is not exceeding provider limits
- Review key permissions, organization or project settings, rate limits, network connectivity, request timeouts, and the complete provider error message
How do I rotate or revoke an API key safely?
- Create a replacement API key in your provider dashboard and store it securely
- Update the key in AI Webmaster → Settings
- Save the settings and test the connection if that option is available
- After confirming that the replacement works, revoke the old key in your provider dashboard and review recent provider activity
API key security FAQ
Is an API key required for every feature?
Can I use multiple API keys?
Should I send my API key to support?
What should I do if my API key is exposed?
Use AI features with appropriate safeguards
Configure the provider key in AI Webmaster, review the data selected for each task, and use administrator-supervised AI-assisted workflows on your WordPress site. Verify the connection with the testing option included in your installed version, monitor provider usage and billing, and remove sensitive information before sending any request.