Reference for the "Added support for encrypting and decrypting settings fields." feature

[grand_lady (Jeff Chimene)]

I swear I saw a documentation reference to this feature, but I can’t find it now.

I want to manage an external system’s API key as metadata for a Feed Add-On. AFAICT, this settings field management is for at-rest data in case the WP database is hacked.

Related to

Addon's "update_plugin_settings" called twice for custom type

I’m trying to encrypt one addon configuration field whose purpose is as an API key. Based on this $field definition: array( 'name' => 'apikeyStatus', 'type' => 'apikey', 'save_callback' => array($this, 'update_apikey'), ), I have this function: public function update_apikey($field, $field_value) { <field value duplicate check logic snipped> if (\GFCommon::current_user_can_uninstall()) …

OAuth will eliminate this as an issue, but not yet.