I am making a very simple plugin to contact OneSignal, a service to send notifications to an android app, when a post is published.

This plugin have no interface, only when a post is published by an admin is called but there are my API Keys of OneSignal showed.

function sendMessage($postTitle, $postLink)

 $heading = array(
        "en" => "New post!");

 $content = array(
        "en" => $postTitle);

     $fields = array(
        'app_id' => "MY API KEY",
        'included_segments' => array('All'), 'data' => array("postLink" => "$postLink"), 'contents' => $content, 'headings' => $heading);

$fields = json_encode($fields);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://onesignal.com/api/v1/notifications");
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json; charset=utf-8',
                                               'Authorization: Basic MY SECOND API KEY'));
    curl_setopt($ch, CURLOPT_HEADER, FALSE);
    curl_setopt($ch, CURLOPT_POST, TRUE);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);

$response = curl_exec($ch);

    return $response;

As you can see the API KEY are in clear. I should hide this keys in some way? If yes, how? Please keep in mind this is my first time I "develop" something in Wordpress so maybe I make something wrong.

Thank you!


There is nothing you can do to hide the API keys.

If you look at the wp-config.php file, it contains the username and password to access the database in plain text. WordPress doesn't even try obfuscate them.

If you're distributing this plugin, another options would be to have the plugin users each obtain an API key, create an options page so that they can input their key, and store the key in the database. Then when you need to use the API, get the option from the database and use their key.

| improve this answer | |
  • +1 to make the plugin users obtain their own key, but sometimes it is hard for non technical users – Mark Kaplun Feb 25 '17 at 14:55
  • I have forgot to say, but this plugin is made just for the website and it isn't intended to share with others, so it stay just for my team. So, in short, I can stay pretty safe with it? – Ghimbo21 Feb 25 '17 at 17:31
  • pretty safe, but not 100%. rouge plugins or themes could theoretically read your API key. if your site gets hacked, they'll have your key. – Nathan Johnson Feb 25 '17 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.