Athenian Secure API & Credentials Manager

Developer starting point

The documentation describes the reviewed storage and access architecture. It does not claim that existing production credentials are readable or that any external provider transaction has succeeded.

Technical Architecture

File Structure Reviewed

athenian-secure-api-key-manager.php
includes/
  Admin.php
  CLI.php
  Rest.php
  SecureStore.php
assets/
  css/admin.css
  js/admin.js
docs/
  asakm-marketing-document.md
  athenian-platform-marketing.md
  athenian-platform-technical.md

Bootstrap Flow

1. The main plugin file defines constants such as ASAKM_VERSION, ASAKM_PATH, ASAKM_URL, and ASAKM_OPT_PREFIX.
2. Core classes are loaded from includes/SecureStore.php, includes/Admin.php, and includes/Rest.php.
3. Admin assets are enqueued only on the plugin settings page.
4. PHP helper functions are declared if not already present.
5. ASAKM_LOADED is defined for detection by dependent plugins.
6. WP-CLI support is conditionally loaded during plugins_loaded when WP_CLI is active.

Main Classes

| Class | Responsibility | | --- | --- | | Athenian\SecureAPI\SecureStore | Encrypts, decrypts, saves, fetches, deletes, lists, and masks service credentials. | | Athenian\SecureAPI\Admin | Registers the settings page, renders the credential workspace, manages save/delete requests, and exposes the service registry. | | Athenian\SecureAPI\Rest | Registers admin-only health, masked status, and OpenAI proxy REST routes. | | Athenian\SecureAPI\CLI | Registers the asakm WP-CLI command group. | | Athenian\SecureAPI\ASAKM_Command | Implements diagnostics, service listing, get/set/delete, and validation commands. |

Storage Model

Each service is stored in a separate WordPress option using the configured prefix:

asakm_<service_slug>

For example:

asakm_openai
asakm_google_maps
asakm_stripe
asakm_paypal

The option value is an encrypted blob shaped like:

{
  "iv": "base64-encoded initialization vector",
  "tag": "base64-encoded authentication tag",
  "ct": "base64-encoded ciphertext"
}

Options are saved with autoload disabled to avoid loading secrets into memory on every WordPress request.

Encryption Model

• Cipher: aes-256-gcm
• Key derivation: SHA-256 over WordPress auth keys and secure auth salt
• IV length: 12 random bytes
• AAD: asakm:v1
• Tag length: 16 bytes
• Storage output: Base64-encoded iv, tag, and ciphertext fields

Masking Model

The masked view preserves enough structure to indicate that a value exists without showing the raw secret:

• Short values are replaced with asterisks.
• Longer values show the first three and last three characters with the middle masked.
• Non-string values are shown as (set).

This makes the plugin useful for support and diagnostics while reducing accidental credential disclosure in admin screenshots or shared support sessions.

WordPress Hooks and Integration Points

Actions

| Hook | Usage | | --- | --- | | admin_enqueue_scripts | Loads the admin CSS/JS on the ASAKM settings page only. | | plugins_loaded | Conditionally loads WP-CLI support. | | admin_menu | Registers the settings page under Settings. | | admin_post_asakm_save | Handles credential save requests. | | admin_post_asakm_delete | Handles full service credential deletion. | | rest_api_init | Registers the plugin REST routes. |

Filters

| Filter | Usage | | --- | --- | | asakm/services_meta | Allows plugins to extend the service registry with new credential groups. |

Admin Workflow

Configure a Service

1. Open Settings > Athenian API Keys.
2. Select a service from the sidebar.
3. Review the service description and required fields.
4. Enter new credential values.
5. Save changes.
6. Confirm the service indicator changes to configured.

Rotate a Credential

1. Select the service.
2. Enter only the field that needs to change.
3. Leave other fields blank to preserve them.
4. Save changes.
5. Use /health, /status/<service>, or wp asakm validate to confirm state.

Clear a Single Field

1. Select the service.
2. Enter a single hyphen (-) in the field to clear.
3. Save changes.

Delete a Service Configuration

1. Select the service.
2. Click Delete Stored Values.
3. Confirm deletion.
4. The service status changes back to missing/unconfigured.

Developer Usage Examples

Fetch an Entire Service Configuration

$openai = asakm_fetch('openai');
$api_key = $openai['api_key'] ?? '';

Fetch a Single Field with a Default

$paypal_env = asakm_get('paypal', 'environment', 'sandbox');

Check Whether the Manager Is Available

if (defined('ASAKM_LOADED') && function_exists('asakm_get')) {
    $stripe_secret = asakm_get('stripe', 'secret_key');
}

Save a Custom Service Programmatically

asakm_save('custom_vendor_api', [
    'api_key' => $key,
    'endpoint' => $endpoint,
]);

Security Notes

Strengths

• Uses authenticated encryption via AES-256-GCM.
• Derives encryption material from WordPress salts/keys instead of shipping a static plugin key.
• Saves each service in a separate non-autoloaded option.
• Masks secrets in the admin after storage.
• Restricts admin pages, save/delete actions, REST health/status, and proxy routes to manage_options users.
• Provides server-side helper functions so other plugins do not need to expose secrets to the browser.
• Includes WP-CLI doctor checks for OpenSSL/cipher support and encryption round-trip validation.

Operational Considerations

• Because encryption is derived from WordPress salts/keys, changing those salts can make existing encrypted values unreadable unless credentials are re-entered.
• Raw values are available through PHP helper functions and WP-CLI to trusted server operators, so server access and administrator accounts should remain tightly controlled.
• The included OpenAI proxy route is admin-only and should be treated as an example/controlled backend workflow rather than a public frontend API.
• Browser-safe keys, such as a Google Maps browser key, still require provider-side restrictions because they may need to be used client-side by consuming plugins.

Implementation Review Notes

• The plugin is lightweight and focused: five PHP files plus admin CSS/JS and documentation.
• The current version does not register shortcodes, custom post types, taxonomies, database tables, scheduled jobs, or WooCommerce-specific hooks.
• The primary data model is WordPress options prefixed with asakm_.
• The admin page is registered under Settings rather than as a top-level menu.
• Service metadata is intentionally filterable so this plugin can act as a credential backbone for other Athenian modules.
• PHP linting passed for all PHP files in the inspected package.