The Connectors API in WordPress 7.0 brings external service connections into Settings > Connectors. When an AI provider plugin registers itself with the AI Client default registry, WordPress discovers it and creates the matching Connector without requiring the plugin to build another credential screen.
Why it matters
WordPress checks provider credentials in a defined order: an environment variable first, then a PHP constant, and finally the value stored in the database. This keeps production secrets in the server environment.
The database value is not currently encrypted, even though the interface masks it. Visual masking is not encryption. Never place the key in a theme, repository, downloadable file, or browser response. A plugin should also detect whether a configured provider supports the capability it needs before showing an AI action to the user.
Try it quickly
On a local site, install a compatible provider plugin and open the Connectors screen. Test with a dedicated development key, then move the key to an environment variable and confirm that WordPress gives it priority. Disconnect the provider too, and verify that your feature stops with a clear error instead of sending a partial request.
In production, use a restricted key, monitor quota, and rotate it immediately if exposure is suspected. Do not print the value in logs or error messages.
Source: the official Connectors API dev note.