HuxxConnect encrypts stored credentials on every tier; the tier controls where the encryption key lives. This page covers selecting a tier and switching between them. For what each tier protects against, read Encryption Tiers Explained.

Quick version:

1. Go to HuxxConnect → Settings, Security card, Encryption Key Source section.
2. The tier tile marked Active is your current tier. Click a different tile to open its switch panel.
3. Standard: click Switch to Standard. Advanced: click Generate Keys, add the two define() lines to wp-config.php, click Verify & Activate. Locked: read the warning, click Switch to Locked.
4. All stored credentials are re-encrypted with the new key automatically — the toast reports how many APIs were re-encrypted.

Find the tier selector#

Go to HuxxConnect → Settings. In the Security card, the Encryption Key Source section shows three tiles:

• Standard — “Auto-generated key stored in database. Portable across environments.”
• Advanced — “Custom key defined in wp-config.php. Most secure option.”
• Locked — “Site-specific configuration. Not portable during staging or server migrations.”

The current tier carries an Active badge. Clicking the active tile does nothing; clicking any other tile expands its switch panel below the grid (clicking it again collapses the panel, and Cancel does the same).

Switch to Advanced (keys in wp-config.php)#

1. Click the Advanced tile.

2. Click Generate Keys. The panel shows a two-line snippet:

   define( 'HUXX_CONNECT_ENCRYPTION_KEY', '...generated 64-character key...' );
   define( 'HUXX_CONNECT_ENCRYPTION_SALT', '...generated 64-character salt...' );
   

3. Click Copy to Clipboard and add the lines to wp-config.php before the That's all, stop editing! comment. (Regenerate produces a fresh pair if you need one.)

4. Back in Settings, click Verify & Activate. HuxxConnect confirms the constants are live, re-encrypts every stored credential with the new key, and moves the Active badge to Advanced.

Keep a copy of the two constants somewhere safe (a password manager) — they are your migration path. To move this site later, copy them into the destination server’s wp-config.php; the Settings page repeats this guidance in its Migration & Portability section while Advanced is active.

Switch to Standard (key in the database)#

1. Click the Standard tile. The panel explains it will switch to auto-generated portable keys stored in the database.
2. Click Switch to Standard. Credentials are re-encrypted with a stored key (generated now if none exists).

If you are coming from Advanced, the panel notes that you can remove the HUXX_CONNECT_ENCRYPTION_KEY and HUXX_CONNECT_ENCRYPTION_SALT constants from wp-config.php afterward — the stored key is now authoritative, so the constants are inert leftovers.

Switch to Locked (key from WordPress salts) — read the warning#

The Locked panel opens with a downgrade warning, styled as a warning for a reason:

Warning: This locks encryption to this server’s WordPress configuration. Credentials cannot be migrated to other servers (staging, host migration, etc).

Switching to Locked derives the key from this install’s WordPress salts and deletes the stored key. From that point, any migration, clone, or salt rotation makes the existing credentials permanently undecryptable — the recovery is re-entering them by hand. If that trade-off is acceptable, click Switch to Locked.

What re-encryption does#

Every tier switch decrypts all API-level credentials and per-endpoint auth overrides with the old key and immediately re-encrypts them with the new key. Nothing is left readable in between, and no request behavior changes. The confirmation toast reports the outcome — “Encryption switched to Advanced. 3 API(s) re-encrypted.” — and appends a count of APIs whose credentials could not be converted (per-endpoint auth-override failures do not appear in the toast — they surface via Credential Health). The Environment Lock fingerprint is also re-established with the new key, so a tier switch never locks you out of your own site.

If it didn’t work#

“HUXX_CONNECT_ENCRYPTION_KEY constant not detected. Add it to wp-config.php and try again.” — You clicked Verify & Activate before the constants were live. Check that both define() lines are in wp-config.php on this server, above the That's all, stop editing! comment, with no typo in the constant names, then click Verify & Activate again. On hosts with opcode or config caching, a page reload may be needed first.

“Already using this encryption tier.” — The switch you requested targets the tier that is already active (this can appear if two browser tabs raced). Reload the page; the Active badge shows the real current tier.

The toast reports failed APIs, or a “Credential Health” table appears. — One or more credentials could not be decrypted with the old key, so they could not be re-encrypted. The Security card lists each affected API and field under Credential Health; open each linked API and re-enter those credentials. The rest of your APIs are unaffected.