Question: Secure API key storage in WordPress Studio Preview sites
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 18/100
Research direction
The payload names no source files, tests or entry points, so there is no code to start from. The work is answering six questions about how Studio Preview sites handle wp-config.php constants, environment variables, secrets outside the document root, persistence across "Update Preview", and backups. Check the Studio docs or ask the maintainers for the platform behaviour before anything is written. Done means each question has a documented answer or a recommended approach that the issue author can act on.
Written by the indexing model from the issue text.
Description
Hello WordPress Studio team,
I am developing an AI shopping agent integration for a WooCommerce store using WordPress Studio.
I currently have an existing Preview site (Preview 2), and I need to securely store a private API authentication key called AAD_AGENT_KEY.
My WordPress plugin reads this key as a PHP constant.
Before proceeding, I would appreciate clarification on the following:
-
Can custom PHP constants defined in the local wp-config.php be transferred to a Studio Preview site?
-
Is there a supported way to configure private environment variables or server-side secrets in Preview sites?
-
Can a secret be stored outside the public document root and accessed securely by PHP?
-
Will these settings persist after using "Update Preview"?
-
Are server-side secrets excluded from publicly accessible files, exports, and backups?
-
If none of these options are supported, what is the recommended secure approach for authenticating an external AI agent with a WooCommerce store hosted on Studio Preview?
I would prefer to continue using my existing Preview site without creating a new one.
I have not generated or deployed the authentication key yet.
Thank you for your guidance!
- Dominant language
- TypeScript
- Stars
- 543
- Forks
- 104
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 239
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Automattic/studio
-
Enhancement
Difficulty 1/5 Under an hour Newbie friendliness 75/100
Automattic/studio#3017 · 4 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Automattic/studio#2868 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 58/100
Automattic/studio#5200 ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
Automattic/studio#5187 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
Automattic/studio#5169 ·
Maintainers usually reply within 1 day
All issues in Automattic/studio
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
paperclipai/paperclip#17151 ·
Maintainers usually reply within 1 day
-
needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
AgoraIO-Extensions/agent-infra#3159 ·
Maintainers usually reply within 1 day
-
blocklist addition
Difficulty 1/5 Under an hour Newbie friendliness 66/100
MetaMask/eth-phishing-detect#304596 ·
Maintainers usually reply within 1 day
-
friction
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
kentcdodds/kody#4142 ·
-
[Bug] Statistics | Task statistics are always empty on MikroORM with MySQL or SQLitePossibly taken @NdekoCode claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
ever-co/ever-gauzy#11214 ·
Maintainers usually reply within 1 day