Kagivault
Encrypts WordPress AI Connectors API keys (OpenAI, Anthropic, Google, OpenRouter) at rest with XChaCha20-Poly1305 + Argon2id.
Use with caution
Kagivault works, but test it on a staging site before relying on it in 2026. Was last updated 4 months ago, and scores 49/100 on our health check.
- Small user base (<10 active installs)
- Very few reviews so far
- Needs PHP 8.3 or newer
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Kagivault stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| AI | >100 |
| ai connectors | >100 |
| api keys | >100 |
| connectors | >100 |
| encryption | >100 |
About Kagivault
From the official readme · v0.1.2Description
Kagivault is an encrypted vault for the WordPress 7.0 AI Connectors API. Out of the box, WordPress stores the API keys you configure on Settings → Connectors (OpenAI, Anthropic, Google, OpenRouter, and any other AI provider registered with the AI Client) as plaintext rows in the wp_options table. Anyone with database access — backups, leaked dumps, host migration files — can read them.
Kagivault wraps each AI Connectors key with XChaCha20-Poly1305 (authenticated encryption) and protects the data-encryption key with a vault password derived through Argon2id. The vault password is never persisted, and the vault automatically re-locks after a short, configurable idle timeout. Unlock from the admin UI, and the WordPress AI client transparently sees the decrypted keys — no other plugin changes required.
Highlights
- Drop-in encryption for every AI Connectors provider (
connectors_ai_*_api_keyrows) - Vault password unlock with idle-timeout auto-lock
- Recovery key as a parallel unlock path
- Optional: link a WordPress login password so signing in automatically unlocks the vault
- Easy-mode initialization — no separate vault password to remember if you just want one-click setup
- Transparent for the core WP AI client and the Connectors admin page
- Versioned blob format for future cipher upgrades
Requirements
- WordPress 7.0 or newer (uses the Connectors API introduced in 7.0)
- PHP 8.3 or newer
- PHP sodium extension with XChaCha20-Poly1305 AEAD (
sodium_crypto_aead_xchacha20poly1305_ietf_encrypt) - PHP sodium extension with Argon2id (
SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13, requires libsodium 1.0.13+)
The bundled sodium extension shipped with PHP 8.3+ on most platforms (Debian/Ubuntu php-sodium, RHEL php-sodium, Alpine php-sodium, Windows official builds) includes both capabilities. The plugin refuses to activate and surfaces a clear admin notice if either is unavailable.
Privacy Policy
Kagivault does NOT:
- Send any data to external servers
- Track users
- Use cookies for tracking
- Share data with third parties
Kagivault DOES:
- Process and store encrypted API keys locally on your server (
wp_options) - Keep the data-encryption key only in a short-lived transient that expires after the configured idle timeout
Support
For support, bug reports, or feature requests:
- Website: https://github.com/benridane/kagivault
Development
Development happens on GitHub. Pull requests welcome!
- Follow WordPress coding standards
- All code must pass
wp plugin check kagivault
Installation
- Upload the
kagivaultdirectory to/wp-content/plugins/. - Activate the plugin through the Plugins menu in WordPress. If sodium or Argon2id is missing, activation aborts with a specific message listing what is missing.
- Visit Settings → Kagivault and set a vault password. Store the recovery key shown to you – it cannot be recovered later.
Frequently asked questions
What happens to my AI keys while the vault is locked?
They cannot be decrypted, so AI calls that rely on those keys will not have a key available for that request. Unlock the vault from Settings → Kagivault to restore functionality.
Where is the vault password stored?
Nowhere. It is held only in browser memory long enough to unlock the vault. The derived data-encryption key lives in a short-lived transient that expires after the configured idle timeout.
Does it cover keys defined in wp-config.php?
Not in this release. Constants and environment variables still take precedence over the encrypted database entries, as defined by core. A later release will add a migration path.
Can I change the idle-lock timeout?
Yes. Kagivault auto-locks after one hour of inactivity by default. Override per environment by defining the constant in wp-config.php: define( 'KAGIVAULT_IDLE_TIMEOUT', 1800 ); // seconds The constant always wins over the database setting. Values below 60 seconds are clamped to 60.
Changelog
Documentation and project-link updates. No functional changes.
0.1.2
- Updated the plugin and support links to point to the GitHub repository.
- Clarified the readme and admin UI wording describing how the vault locks and unlocks.
0.1.1
- Default idle-lock timeout extended from 30 minutes to 1 hour.
- Added
KAGIVAULT_IDLE_TIMEOUTconstant so the timeout can be overridden fromwp-config.php(takes precedence over the database setting).
0.1.0
- Initial release: encrypted storage for WordPress AI Connectors API keys (OpenAI, Anthropic, Google, OpenRouter, …), vault-password unlock with idle auto-lock, recovery key, and optional WP login-password auto-unlock.
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Kagivault alternatives
All AI plugins →
FAQ
Kagivault: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 5, 2026
Is Kagivault free?
Yes. Kagivault is free to download and use from the official WordPress.org plugin directory.
Is Kagivault safe to use in 2026?
Kagivault works, but test it on a staging site before relying on it in 2026. Was last updated 4 months ago, and scores 49/100 on our health check.
How many websites use Kagivault?
Kagivault is active on <10 WordPress websites and has been downloaded 297 times since it launched in June 2026. It was downloaded 82 times in the last 30 days.
Does Kagivault work with WordPress 7.1?
Kagivault is officially tested up to WordPress 7.0.6, while the latest release is 7.1.2. It may still work, but try it on a staging site first.
What PHP version does Kagivault need?
Kagivault requires PHP 8.3 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was Kagivault last updated?
The latest version, 0.1.2, was released on June 6, 2026 (4 months ago).
Who makes Kagivault?
Kagivault is developed and maintained by miya.
What are the best alternatives to Kagivault?
The most popular alternatives to Kagivault are Elementor Website Builder (10M+ installs), All in One SEO (2M+ installs) and AI Agent by SiteGround (1M+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
