API Key Management
How to generate, store, rotate, and revoke Respira API keys safely.
API Key Management
API keys authenticate your AI assistant (via the MCP server) to your WordPress site.
Generate an API Key
- Go to WordPress Admin → Respira → API Keys
- Click Generate API Key
- Copy the key and store it securely (you won’t see it again)
Access profiles and scopes
Every key carries an access profile, chosen when you create it. The profile decides which tools the key can call:
| Profile | What the key can do |
|---|---|
| Full access | Every tool, within the site's governance rules |
| Builder | Content editing plus every page builder operation; no plugins or users |
| Content editor | Read and write pages, posts and media; no plugins, users or settings |
| Read only | Read pages, posts, site context and analysis; no writes |
Underneath the profile, each key holds scopes: read_basic, read_fidelity and write for every profile that writes, plus read_meta_all and admin for Full access only. A request outside the key's profile or scopes is refused, and the refusal names the key that was checked. If you narrow a key, the narrower scope applies to the next call, including calls already queued.
Give each assistant, contractor or automation its own key with the smallest profile that does the job.
Expiry
A key keeps working until you revoke or rotate it, or until the site's licence ends, which switches off every key on that site. Keys do not yet take an expiry date you choose. For short-lived access, use OAuth sign-in: its tokens expire on their own.
Rate limit
Each key can make 1,000 requests an hour by default. The limit exists to stop a runaway agent, not to meter normal work; an active session rarely passes 200 calls an hour. Change it in Respira → Settings → Rate limit, or with wp option update respira_rate_limit 2000. See Usage limits for the rest.
Store Keys Safely
- Treat the key like a password
- Do not paste it into public tickets or screenshots
- Prefer environment variables or local config files
Rotate Keys
If you suspect a leak or want to rotate regularly:
- Generate a new key
- Update your MCP config
- Revoke the old key
Revoke Keys
Revoke any key you no longer need in Respira → API Keys.