Storing your provider key with us

What this is for

Normally, you enter your Claude, DeepL, Gemini, Google Translate or OpenAI key on each site. If you manage twenty sites, you need to repeat that twenty times whenever the key changes.

Instead, you can store the key once in your account. Any site on any of your licences can then collect it using a button in the plugin. This is optional, and nothing else in WPGlotty depends on it.

How it is kept

The key is strongly encrypted before it is stored.

The stored key is linked to your account and cannot be moved to someone else’s. Once stored, nobody can view it on a screen, in an export or through support, not even us. Your account page shows only the provider, the last four characters and the date.

You need a licence key and a code

Your licence key is stored in wp_options on each site, including backups and staging copies. A licence key alone cannot collect your provider key. If it could, anyone with an old backup or a forgotten staging site could reach your provider account.

To collect a stored key, you need your licence key and a code. Open a collection window on your account page, then enter the displayed code in the plugin. The window stays open for fifteen minutes and works for one site only. Open a new window for each site.

A licence key from an old backup cannot collect provider keys without the code. The collection window closes after five incorrect attempts.

Checking a key works

Click Test beside a stored key to check whether the provider recognises it. The result says whether the key was recognised or refused, or whether the provider could not be reached. An unreachable provider does not mean the key is invalid.

The test translates nothing and costs nothing, so you can repeat it as often as you need. If a key is refused, check that you copied it fully and that the provider has not revoked it.

You see everything that happens

Your account lists every collection with the site, request address and time. You also receive an e-mail for each collection and refusal. A refusal notice tells you someone tried a licence key without the code.

Deleting a key removes it from our servers immediately. Sites that collected it keep their copies, encrypted with their own WPGlotty encryption key if set, or their WordPress salts. To stop those copies working too, change the key at your provider.

If you would rather not

You can keep entering your key on each site instead. If you do not use account storage, we never receive the key. It goes directly from your server to your provider.

When a site collects keys, it receives every key you have stored, not only the one it uses for translation. Consider this before collecting keys on a site you do not control.