Security & API Keys

← Free vs Pro · Home · Next: Troubleshooting & FAQ →

How access works #

There are two ways for an AI app to sign in, and you choose one per app on the Connection screen.

Sign in with WordPress (OAuth) — recommended #

The app opens your site and asks you to approve it. You sign in with an administrator account, read what it will be allowed to do, and press Allow. No key is copied anywhere: the connector address carries none.

• Each person gets their own connection. Everyone who connects this way is listed under Connected people on the Connection screen, and History & Activity names who made each change.
• End one connection at a time. Press Revoke next to a person and only their connection stops; everyone else keeps working.

Use the connector key (API key) #

Every Divi Connect site has one secret connector key, generated automatically when you activate the plugin. It looks like:

dvc_a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718

This key is what authorizes your AI to read your design system and build pages. It is used in two equivalent ways:

• In the MCP connector URL — the key is the last part of the URL:
  https://yoursite.com/wp-json/divi-connect/v1/mcp/dvc_…
• As a request header — X-Divi-Connect-Key: dvc_… (used when working with curl/terminal).

A request with the correct key is treated as an administrator on your site (that’s what lets it publish pages with valid Divi markup). So treat the key — and the MCP URL — like a password.

Treat the connector URL as a secret #

Because the key is embedded in the MCP URL, anyone who has that URL can build and delete pages on your site. Therefore:

• ✅ Paste it only into your own AI app’s connector settings.
• ❌ Don’t post it in screenshots, support tickets, public repos, or shared docs.
• ❌ Don’t share it in a chat with anyone you don’t trust.

The screenshots in this guide use a fake sample key for exactly this reason.

Regenerating the key #

If a key is ever exposed (or you just want to rotate it):

1. Go to Divi Connect → Connection.
2. Click Regenerate next to the API Key.
3. Confirm. A new key is generated immediately, and the old key (and old MCP URL) stops working at once.

After regenerating, update the connector in your AI with the new MCP URL.

Other security notes #

• HTTPS only for cloud. When connecting claude.ai (cloud), always use an https:// URL so the key isn’t sent in the clear. Local sites used with Claude Code/Desktop on the same machine are an exception.
• Per-site keys. Each site has its own key, so a leak on one site never affects another.
• No data of yours leaves except what you build. The plugin exposes your design system and page operations to your AI; it doesn’t send your content anywhere else.
• Uninstalling is clean. Deleting the plugin removes its connector settings, and keeps your design history (the list of design-system changes you can undo) unless you choose to remove that too in Settings. It never touches your Divi data — your colors, variables, and presets belong to your site and are left untouched.

Multi-site / agencies #

If you connect several sites to one AI account, each connector is named after its site — for example “Divi Connect – Client A (clienta.com)”. Your AI will also tell you which site it’s pointed at before building, so you can confirm you’re publishing to the right place.

A Pro 5-site or Unlimited plan is designed for this agency workflow. See Free vs Pro.

← Free vs Pro · Home · Next: Troubleshooting & FAQ →