Constants

Use wp-config.php for secrets, for per-environment configuration, and for the emergency switches. Two kinds of constant live here, and they behave differently. The proxy, IP and server-mode constants below take over from the matching setting, and the screen shows the field as locked. The OAuth credentials are a source you choose on screen: each provider has a Where are the keys? option, and the constants are read only when it is set to wp-config.php.

Social login credentials

define('FLUENT_AUTH_GOOGLE_CLIENT_ID', '…');
define('FLUENT_AUTH_GOOGLE_CLIENT_SECRET', '…');
define('FLUENT_AUTH_GITHUB_CLIENT_ID', '…');
define('FLUENT_AUTH_GITHUB_CLIENT_SECRET', '…');
define('FLUENT_AUTH_FACEBOOK_CLIENT_ID', '…');
define('FLUENT_AUTH_FACEBOOK_CLIENT_SECRET', '…');

The recommended place for OAuth secrets. Set the provider’s key source to wp-config.php on the social login screen, or these are ignored and the values saved in the database are used. See Social login.

define('FLUENT_AUTH_SOCIAL_REDIRECT_URL', 'https://example.com/login/');

Overrides the callback URL the providers send users back to, for a site whose login page is not wp-login.php.

Visitor IP

define('FLUENT_AUTH_TRUSTED_PROXIES', '10.0.0.0/8, 203.0.113.5');
define('FLUENT_AUTH_PROXY_IP_HEADER', 'HTTP_X_REAL_IP');

Comma-separated addresses or ranges, and the $_SERVER key of the header they set. See Visitor IP and proxies.

Authenticator secret encryption

define('FLUENT_AUTH_SECURITY_KEY', 'a long random string');

An authenticator secret is the one credential FluentAuth has to be able to read back, because a code is checked by generating it. A password or a recovery code can be hashed; this cannot. With this constant set, the secrets are encrypted before they are stored, so a copy of your database is not enough to generate anybody’s codes.

Any length and any characters will do; the key is derived, not used raw. Set it before anyone enrols, then turn encryption on from Settings → Two-Factor Authentication.

FluentAuth deliberately does not fall back to AUTH_SALT. Rotating the salts is ordinary advice after a compromise, and several tools have a button for it, so borrowing them would quietly take every enrolled authenticator app with it.

Keep the key with your other deployment secrets, and keep it out of the repository. If wp-config.php is overwritten on deploy and the key goes with it, FluentAuth notices and says which of the two things happened: the line is missing, or the value is not the one these secrets were encrypted with. Both are recoverable while you still have the old value somewhere. Put the line back, or paste the previous value in to re-encrypt everything under the new one. If the old key is genuinely lost, reset the affected users from the enrolment screen and they enrol again.

fluent_auth/secret_key_material supplies the key from somewhere else, for a Bedrock install reading .env or a host with a key management service.

Emergency switches

define('FLUENT_AUTH_DISABLE_IP_RESTRICTION', true);

Disables the IP block list and the role-to-allow-list restriction. See IP access rules.

Remote auth

define('FLUENT_AUTH_SERVER_MODE', true);

Turns the site into an authentication server for other sites. See Remote auth.

Defined by the plugin

Use defined('FLUENT_AUTH_VERSION') to test for the plugin from another plugin or theme.