Credentials
The two credentials WP Octo has, where each belongs, and how each is kept.
Two credentials that look alike and are not
| What it opens | Belongs | |
|---|---|---|
| API key | the platform's own API | in an integration |
| Workspace token | the worker on every managed site | on the sites |
Putting an API key on a managed site hands a key to the platform to anyone who compromises that site. Putting a workspace token in an integration gives that integration every site in the workspace. The dashboard shows each where it belongs, and the worker has nowhere to put an API key.
How they are kept on the platform
Secrets — workspace tokens, API keys, storage credentials — are stored encrypted. They are never shown in a page, written to a log, included in an export or put in an audit record. Where a person needs to recognise one, a fingerprint is shown.
The worker plugin contains no storage credential and no platform credential. The zip you install is the same for every site; the pairing happens afterwards.
How the workspace token reaches a site
The platform installs it on the site where it can reach the site, and checks that the site accepts it — and refuses a wrong one — before it trusts the site. Where the platform cannot reach the site, an administrator pastes the token into the worker's settings — Install and connect the worker.
Revoking
An API key is revoked under Workspace settings → API keys and stops working at once; create a new one for the integration. For the workspace token, contact support.
Object storage
The site never sees a storage key. To upload a backup or download one for a restore, the platform hands the site links that read or write one file for a limited time.