Security & API Keys

← Free vs Pro · Home · Next: Troubleshooting & FAQ →

How access works #

Every Divi Connect site has one secret connector key, generated automatically when you activate the plugin. It looks like:

dvc_a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718

This key is what authorizes Claude to read your design system and build pages. It is used in two equivalent ways:

In the MCP connector URL — the key is the last part of the URL:
https://yoursite.com/wp-json/divi-connect/v1/mcp/dvc_…
As a request header — X-Divi-Connect-Key: dvc_… (used when working with curl/terminal).

A request with the correct key is treated as an administrator on your site (that’s what lets it publish pages with valid Divi markup). So treat the key — and the MCP URL — like a password.

Treat the connector URL as a secret #

Because the key is embedded in the MCP URL, anyone who has that URL can build and delete pages on your site. Therefore:

✅ Paste it only into your own Claude account’s connector settings.
❌ Don’t post it in screenshots, support tickets, public repos, or shared docs.
❌ Don’t share it in a chat with anyone you don’t trust.

The screenshots in this guide use a fake sample key for exactly this reason.

Regenerating the key #

If a key is ever exposed (or you just want to rotate it):

Go to Settings → Divi Connect.
Click Regenerate next to the API Key.
Confirm. A new key is generated immediately, and the old key (and old MCP URL) stops working at once.

After regenerating, update the connector in Claude with the new MCP URL.

📷 Screenshot needed: The Regenerate confirmation prompt (“Regenerate the API key? The old key will stop working.”).

Other security notes #

HTTPS only for cloud. When connecting claude.ai (cloud), always use an https:// URL so the key isn’t sent in the clear. Local sites used with Claude Code/Desktop on the same machine are an exception.
Per-site keys. Each site has its own key, so a leak on one site never affects another.
No data of yours leaves except what you build. The plugin exposes your design system and page operations to your Claude; it doesn’t send your content anywhere else.
Uninstalling is clean. Removing the plugin deletes only its own options (the API key and plan flag). It never touches your Divi data — your colors, variables, and presets belong to your site and are left untouched.

Multi-site / agencies #

If you connect several sites to one Claude account, each connector is named after its site — for example “Divi Connect – Client A (clienta.com)”. Claude will also tell you which site it’s pointed at before building, so you can confirm you’re publishing to the right place.

A Pro 5-site or Unlimited plan is designed for this agency workflow. See Free vs Pro.

← Free vs Pro · Home · Next: Troubleshooting & FAQ →