I should hide the API Key in a plugin?

There is nothing you can do to hide the API keys.

If you look at the wp-config.php file, it contains the username and password to access the database in plain text. WordPress doesn’t even try obfuscate them.

If you’re distributing this plugin, another options would be to have the plugin users each obtain an API key, create an options page so that they can input their key, and store the key in the database. Then when you need to use the API, get the option from the database and use their key.

Leave a Comment