Why WordPress 7.0 Centralized AI Keys Through the Connectors API

Before WordPress 7.0, every AI-aware plugin shipped its own settings page, its own API key field, and its own provider switcher logic.

The Problem Connectors Solve

That fragmentation produced predictable consequences. Sites running three AI plugins held three copies of the same OpenAI key, often in wp_options rows nobody could audit. Switching providers meant editing settings in five places and praying no plugin still pointed at the old endpoint. The Connectors API shipped on May 20, 2026 centralizes credential storage and exposes a discovery layer that any plugin can read from, which is one of the headline changes covered in the WordPress 7.0 release rundown.

How the Three Layers Stack

The new infrastructure splits responsibility across three components: the provider plugins, the PHP AI Client SDK, and the Connectors registry. Each layer has a narrow contract, which is what lets the system stay provider-agnostic without sacrificing per-vendor features.

What Each Layer Actually Does

Provider plugins are the bottom layer. WordPress.org publishes three official ones: AI Provider for OpenAI, AI Provider for Anthropic, and AI Provider for Google. Once activated, they auto-register with the PHP AI Client and expose their available models without any glue code from the consuming plugin. The PHP AI Client sits in the middle as a bundled external library that handles request routing, model selection, and response normalization. At the top, the Connectors registry stores API keys and surfaces them through Settings > Connectors in the admin. A community plugin for Ollama covers local LLM workflows for sites that prefer not to send data to third-party APIs.

Sending a Prompt With wp_ai_client_prompt()

The recommended entry point for any plugin sending a prompt is the global helper wp_ai_client_prompt(), which returns a WP_AI_Client_Prompt_Builder instance that catches SDK exceptions and converts them to WP_Error objects.

$result = wp_ai_client_prompt()
    ->using_model_preference( array( 'capabilities' => array( 'text_generation' ) ) )
    ->using_system_instruction( 'You write concise product descriptions.' )
    ->using_user_message( 'Describe a 12oz ceramic coffee mug.' )
    ->generate_text_result();
if ( is_wp_error( $result ) ) {
    error_log( $result->get_error_message() );
    return '';
}
return $result->to_text();

Discovering Registered Connectors

WordPress exposes three public helpers for working with the registry programmatically. They behave like the options API: predictable returns, no side effects, safe to call inside admin screens or REST handlers. Wrapping the calls behind capability checks is the standard pattern.

if ( wp_is_connector_registered( 'anthropic' ) ) {
    $connector = wp_get_connector( 'anthropic' );
    echo esc_html( $connector['name'] );
}
foreach ( wp_get_connectors() as $id => $connector ) {
    printf( '%s: %s', esc_html( $connector['name'] ), esc_html( $connector['description'] ) );
}

Hooking Into wp_connectors_init

Plugins that need to override metadata or register additional connectors must do so on the wp_connectors_init action. Setting the registry instance outside that hook triggers a _doing_it_wrong() notice and the change is rejected silently.

add_action( 'wp_connectors_init', function( $registry ) {
    $registry->set( 'anthropic', array(
        'name'        => 'Anthropic Claude',
        'description' => 'Claude models routed via internal proxy',
        'auth_type'   => 'api_key',
    ) );
} );

Storage and Security Caveats

API keys live in the standard WordPress options table. They are masked in the admin UI but stored without encryption, which means anyone with database read access can recover them in plaintext. The core team has flagged encryption as a follow-up ticket, but until that lands the responsibility falls on the host and the site operator. Keys can also be defined via PHP constants in wp-config.php or pulled from environment variables, which keeps them out of the database entirely. Pairing the Connectors screen with hardened admin access matters more now that a single compromised account exposes every provider on the site. Plugin authors consuming the registry should treat the returned values as secrets and never log them in error messages or stack traces, which is where defensive try-catch blocks earn their keep.

What About Custom Providers?

Third-party providers cannot register their own cards on the Connectors page in 7.0. That capability is scheduled for WordPress 7.1, with a client-side JavaScript registration API to support custom UI. Until then, custom code can override metadata for the existing three slots, which is enough for proxy setups or enterprise gateways that wrap one of the official providers.

The MCP Side of the Conversation

Connectors handle the outbound direction: WordPress calling AI models. The MCP Adapter shipped alongside them handles the inbound direction, which is exactly how WooCommerce stores expose order data to AI agents through registered Abilities.

Migration Notes for Plugin Authors

Sites already using the standalone wp-ai-client Composer package should migrate now. The PHP SDK in that standalone package has been disabled in 7.0, and the REST and JavaScript APIs are scheduled for removal in a future release without further warning. Updating the Requires at least header to 7.0 and swapping any AI_Client::prompt() calls for the core wp_ai_client_prompt() helper covers the bulk of the migration.

Plugins still wrapping procedural credential handling around custom option fields are a natural candidate for the same OOP refactor pattern that splits storage, validation, and presentation into separate classes.

Често задавани въпроси