suredonation_export_secret_option_keys Filter Hook

Overview

The suredonation_export_secret_option_keys filter allows developers to define which SureDonation settings sub-keys contain sensitive information and must be excluded from settings exports.

Use this filter when your extension stores credentials, API keys, gateway tokens, or other secrets inside the SureDonation settings option.

Registering these keys ensures that sensitive information is not exposed in the exported settings JSON.

When to Use This Filter

Use this filter when your add-on:

• Stores API keys in SureDonation settings.
• Stores gateway credentials or tokens.
• Stores third-party service secrets.
• Adds a settings sub-key containing sensitive information.
• Needs to preserve credentials when importing a settings backup.

Filter Signature

apply_filters( 'suredonation_export_secret_option_keys', $keys );

apply_filters( 'suredonation_export_secret_option_keys', $keys );

Parameters

Default Secret Keys

SureDonation protects the following keys by default:

• payment_settings
• ai_settings
• spam_protection_settings

These keys contain sensitive configuration such as payment credentials and service-related settings.

Return Value

Return an array containing the secret option sub-key names.

return $keys;

Non-string values are removed automatically.

If a non-array value is returned, SureDonation treats it as an empty list.

Basic Usage

add_filter( 'suredonation_export_secret_option_keys','your_custom_function',10, 1);

function your_custom_function( $keys ) {

    // Add your secret settings keys here.

    return $keys;

}

add_filter( 'suredonation_export_secret_option_keys','your_custom_function',10, 1);

function your_custom_function( $keys ) {

    // Add your secret settings keys here.

    return $keys;

}

Example: Protect Custom CRM Credentials

If your add-on stores CRM credentials under mysite_crm_settings, register that key as a secret:

add_filter('suredonation_export_secret_option_keys','mysite_protect_crm_credentials', 10, 1);

function mysite_protect_crm_credentials( $keys ) {

    $keys[] = 'mysite_crm_settings';

    return $keys;

}

add_filter('suredonation_export_secret_option_keys','mysite_protect_crm_credentials', 10, 1);

function mysite_protect_crm_credentials( $keys ) {

    $keys[] = 'mysite_crm_settings';

    return $keys;

}

The mysite_crm_settings data will then be excluded from the settings export.

How It Works

The filter is used during the settings export process:

1. SureDonation collects the settings stored in its consolidated option.
2. SureDonation retrieves the list of protected secret keys.
3. The suredonation_export_secret_option_keys filter is applied.
4. Your custom secret keys are added to the protected list.
5. Protected settings are removed from the exported JSON.
6. The remaining settings can be safely exported.

Import Behavior

The same secret-key list is also respected during settings import.

When a settings backup is imported:

• Protected keys from the imported file are not used to overwrite existing credentials.
• Existing credentials remain unchanged.
• Live gateway connections are therefore protected from being cleared by a settings restore.

For example:

Existing Site Settings

        ↓

Gateway Credentials

        ↓

Protected Secret Key

        ↓

Settings Import

        ↓

Existing Credentials Preserved

Security Considerations

Never Remove Default Secret Keys

Do not replace the existing list with your own keys.

Incorrect:

add_filter( 'suredonation_export_secret_option_keys', function () {

        return [ 'mysite_crm_settings' ];

    }

);

add_filter( 'suredonation_export_secret_option_keys', function () {

        return [ 'mysite_crm_settings' ];

    }

);

This removes SureDonation’s default protected keys and can cause sensitive credentials to be included in the exported JSON.

Recommended:

add_filter( 'suredonation_export_secret_option_keys', function ( $keys ) {

        $keys[] = 'mysite_crm_settings';

        return $keys;

    }

);

add_filter( 'suredonation_export_secret_option_keys', function ( $keys ) {

        $keys[] = 'mysite_crm_settings';

        return $keys;

    }

);

Do Not Return an Empty Array

Returning an empty array can cause credential-containing settings to be included in the export.

Always preserve the existing $keys array and add your custom secret keys to it.

For Add-on Developers

If your extension stores secrets inside the SureDonation settings blob, you must register the corresponding settings sub-key using this filter.

SureDonation cannot automatically determine whether an arbitrary settings value contains a credential.

For example:

$keys[] = 'my_plugin_api_settings';

$keys[] = 'my_plugin_api_settings';

This ensures that your API credentials are excluded from exports and preserved during imports.

Related Hooks

• Suredonation_export_campaigns_limit: Controls the maximum number of campaigns included in an export.
• Suredonation_export_one_time_only: Controls export behavior for one-time donations.
• Suredonation_import_campaigns_limit: Controls the maximum number of campaigns imported in a single request.