---
title: "Credentials Vault"
description: "Store reusable authentication secrets encrypted at rest and reference them from webhooks instead of pasting raw Authorization headers."
url: "https://wpwebhooks.org/docs/credentials-vault/"
---

[WP Webhooks](https://wpwebhooks.org/) / [Docs](https://wpwebhooks.org/docs/) / Credentials Vault

Feature since v1.15.0

# Credentials Vault

Store reusable authentication secrets encrypted at rest and reference them from webhooks instead of pasting raw Authorization headers.

Save authentication credentials once — Bearer token, Basic auth (username + password), API key in a custom header, or a raw custom Authorization value — and reference them from any webhook by name. Secrets are encrypted at rest with AES-256-GCM and are write-only over the API: they are never returned to any caller, only a masked hint (e.g. `Bearer ****1234`). The decrypted value is used only at dispatch time to build the outgoing header, and resolved auth headers are redacted in delivery logs.

## Credential types

`bearer` → `Authorization: Bearer <secret>`. `basic` → `Authorization: Basic base64(user:pass)` (covers WordPress Application Passwords on a target site). `api_key` / `custom` → a named header such as `X-API-Key: <secret>`.

## Safe for AI agents

A webhook references a credential via `auth_credential_id` (which takes precedence over the legacy plaintext `auth_header`). An `agent`\-scope token can assign credentials to webhooks but can never read a secret value — so AI assistants can manage webhooks without ever seeing your PATs or passwords.

## Encryption key

By default the encryption key is generated and stored in the database (zero-config, survives WordPress salt rotation). For stronger protection, define `FSWA_SECRET_KEY` in `wp-config.php` to move the key out of the database. Adding it never breaks existing credentials — a one-click in-app migration re-encrypts everything with the new key and then deletes the database copy.

## REST access

Manage credentials via `/wp-json/fswa/v1/credentials` (list, create, update, delete — `full`/`agent` scope), with `GET /credentials/key-status` and `POST /credentials/reencrypt` for the encryption-key migration. Delete is blocked with 409 when a credential is in use unless `force=true` is passed.

/ Related

[API Tokens](https://wpwebhooks.org/docs/api-tokens/)[Custom Request Headers](https://wpwebhooks.org/docs/custom-headers/)[REST API](https://wpwebhooks.org/docs/rest-api/)

/Ready

## Your next automation is  
one sentence away.

[Install Plugin→](https://wordpress.org/plugins/flowsystems-webhook-actions/) [See the Plugin →](https://wpwebhooks.org/wordpress-webhook-plugin/)

$ wp plugin install flowsystems-webhook-actions --activate

## Structured data

```json
{"@context":"https://schema.org","@type":"TechArticle","name":"Credentials Vault — Feature — Webhook Actions Docs","description":"Store reusable authentication secrets encrypted at rest and reference them from webhooks instead of pasting raw Authorization headers.","url":"https://wpwebhooks.org/docs/credentials-vault/","isPartOf":{"@type":"WebSite","name":"WP Webhooks","url":"https://wpwebhooks.org"},"about":{"@type":"SoftwareApplication","name":"Webhook Actions","applicationCategory":"WordPress Plugin"}}
```