Encrypted. When you save an API key in an embeddings or LLM profile, Wyregraf encrypts it before writing it to the database, using a key derived from your site's WordPress security keys (the salts in wp-config.php). Keys are never sent to the browser or included in front-end code, and the System Info diagnostics mask them as *****.
Two practical consequences:
- If your security keys change — some migrations, or a deliberate salt rotation after a security incident — the stored API keys can no longer be decrypted. Wyregraf detects this, clears the unreadable key, and notes it in the error log; the fix is simply to re-paste the API key into each profile and save. Nothing else is lost.
- Set real security keys. On a site still using the placeholder
put your unique phrase heresalts, encryption can't operate and keys are stored as plain text. Generating proper salts (the WordPress secret-key service makes a set) turns encryption on; re-save the profile afterward to encrypt the stored key.
