Repository navigation
Add wp secret commands for the WordPress 7.2 Secrets API #677
Description
Feature Request
WordPress 7.2 adds the Secrets API (#66187, r64337). It stores credentials such as API keys encrypted at rest. Each secret keeps a previous version, so it can be rotated without breaking the code that reads it. Hosts can replace the storage with a wp-content/secrets.php drop-in. Docs: secretsapi.dev.
Core left the WP-CLI commands out, because commands ship as WP-CLI packages. For now they live in the feature plugin. On 7.2 the plugin registers them on core's implementation. I'd like to move them into WP-CLI and wanted to ask where they belong before opening a PR. I opened this here because wp option lives here, and because the Abilities API started the same way in #549.
Proposed commands
Site scope (wp secret):
| Command | What it does |
|---|---|
wp secret set <name> [<value>] [--stdin] |
Stores a secret. --stdin is the documented way to pass the value, so it stays out of shell history and process listings. |
wp secret get <name> [--slot=<current|previous>] [--reveal] |
Shows metadata and a fingerprint. The plaintext is shown only with --reveal. |
wp secret delete <name> |
Deletes a secret. |
wp secret list [<namespace>] |
Lists names, versions and fingerprints. Never values. |
wp secret retire <name> |
Drops the previous version once a rotation is done. |
wp secret import-option <option> |
Moves a plaintext option into the Secrets API (wp_import_option_as_secret()). |
wp secret health |
Runs the three Site Health checks from the CLI. |
Network scope: the same commands for network secrets. In the plugin they're wp network-secret. wp network secret, alongside wp network meta, probably fits WP-CLI's naming better.
Open questions
- Home.
entity-command, next towp option, or a newsecret-commandpackage, likeability-command? - Key management. The plugin also has
rotate(re-wrap the root key under a newWP_SECRETS_KEY),dropin(show the active provider, store and keyring) andgenerate-key. The first two need core internals (_wp_secrets_get_key_manager(),_wp_secrets_get_provider()), which are marked private. I'd suggest leaving those two out until core has a public path for re-wrapping, which is planned for 7.3.generate-keyis probably better as part ofwp config create, which GenerateWP_SECRETS_KEYinwp config createfor the WordPress 7.2 Secrets API config-command#234 covers. - Version gate. Use
before_invokewithUtils\wp_version_compare( '7.2-beta1', '<' ), likeability-commandand the icons commands.
The plugin's migrate-legacy command stays in the plugin. It's for a prototype that is deprecated.
Once the home is settled, I'll open the PR with Behat tests: set, get, list, rotate versions, retire, import, and failing closed when WP_SECRETS_KEY is missing.
Activity