API Key Constants

For enhanced security, PerfLocale supports defining machine translation API keys as PHP constants in your wp-config.php file. When defined as constants, keys are never stored in the database and the settings fields are automatically disabled in the admin panel.

Supported Constants

Add any of these to your wp-config.php file (before the /* That's all, stop editing! */ line):

// DeepL API Key
define( 'PERFLOCALE_DEEPL_API_KEY', 'your-deepl-api-key-here' );

// Google Cloud Translation API Key
define( 'PERFLOCALE_GOOGLE_API_KEY', 'your-google-api-key-here' );

// Microsoft Azure Translator API Key
define( 'PERFLOCALE_MICROSOFT_API_KEY', 'your-microsoft-api-key-here' );

// LibreTranslate API Key
define( 'PERFLOCALE_LIBRE_API_KEY', 'your-libre-api-key-here' );

// LibreTranslate Server URL
define( 'PERFLOCALE_LIBRE_URL', 'https://libretranslate.example.com' );

// External Translation Agency
define( 'PERFLOCALE_AGENCY_URL', 'https://agency.example.com/translate' );
define( 'PERFLOCALE_AGENCY_API_KEY', 'your-agency-api-key-here' );

// GeoIP Providers
define( 'PERFLOCALE_IPINFO_TOKEN', 'your-ipinfo-token-here' );
define( 'PERFLOCALE_IPINFO_LITE_TOKEN', 'your-ipinfo-lite-token-here' );
define( 'PERFLOCALE_IPSTACK_KEY', 'your-ipstack-key-here' );
define( 'PERFLOCALE_IP_API_KEY', 'your-ip-api-pro-key-here' );

// Exchange Rate Providers
define( 'PERFLOCALE_OXR_API_KEY', 'your-openexchangerates-key-here' );
define( 'PERFLOCALE_CURRENCYFREAKS_KEY', 'your-currencyfreaks-key-here' );
define( 'PERFLOCALE_FIXER_KEY', 'your-fixer-key-here' );

How It Works

  1. Constants take priority over database-stored values
  2. When a constant is defined, the corresponding settings field is disabled and shows "Defined in wp-config.php"
  3. Constants are never written to the database or included in data exports
  4. If you remove a constant, the plugin falls back to the database value (if any)

Benefits

  • Security: Keys never touch the database, making them immune to SQL injection or database dumps
  • Deployment: Keys can differ per environment (staging vs production) without database changes
  • Version Control: wp-config.php can be excluded from git while plugin settings are safely committed
  • Backup Safety: Database backups and PerfLocale exports never contain API keys

Environment Variables (Alternative)

If your hosting supports environment variables, you can combine them with constants:

define( 'PERFLOCALE_DEEPL_API_KEY', getenv( 'DEEPL_API_KEY' ) ?: '' );

This reads from the server's environment variables, keeping keys out of any PHP files entirely.