AI Provider settings

Navigation: WordPress Admin → WooCommerce → AI Assistant → AI Provider (also Settings sidebar → AI Provider)

Capability: Viewing and saving keys requires manage_options. Users with only manage_woocommerce see a warning and no credential fields.

Stored in aiwsa_provider_settings. Encrypted keys live in aiwsa_credentials (AES-256-GCM). Keys are never returned by REST or printed into frontend JavaScript (aiwsaBoot).

Provider tabs (OpenAI / Gemini)

What it does Selects the primary provider. The UI shows a segmented control for every registered adapter. This release registers:

• OpenAI (openai) — default model gpt-4o-mini
• Gemini (gemini) — default model gemini-2.0-flash

Default value Empty primary until you save. The UI preselects the first registered provider (OpenAI).

Available options OpenAI, Gemini. Anthropic and OpenRouter hosts appear only on the outbound URL allow-list; they are not selectable providers in this build.

Recommended configuration Pick one provider you have a key for. Add a fallback only if you have a second key.

When to use it Required for conversational replies, AI search intent, AI recommendation queries, and AI cart-recovery copy.

Effect on the frontend Shoppers never see the provider name. With a working key, chat answers become natural language. Without a key, catalog search and fallback messages still run.

Dependencies Outbound HTTPS to api.openai.com or generativelanguage.googleapis.com. sslverify is on. Redirects are not followed.

Important notes A wp-config.php constant wins over a saved key:

• AIWSA_OPENAI_API_KEY
• AIWSA_GEMINI_API_KEY

When a constant is defined, the key fields are hidden and a notice names the constant.

Example A store sets OpenAI + gpt-4o-mini for everyday chat.

API Key

What it does Stores the secret used to call the selected provider. Leave blank when saving other fields to keep the current key.

Default value None.

Available options Any string accepted by the provider. Masked after save.

Recommended configuration Use a restricted key. Prefer a wp-config.php constant on production.

When to use it When you want LLM replies. Skip it if you only need native catalog search.

Effect on the frontend Valid key: AI turns. Invalid/missing: native search + fallback copy. The widget never receives the key.

Dependencies manage_options. Test and Remove buttons use AJAX actions aiwsa_test_api_key and aiwsa_remove_api_key (logged-in admin only; no nopriv).

Important notes Test API Key calls the provider health check. Remove API Key deletes the stored ciphertext for that provider.

Example Paste an OpenAI secret, click Test API Key, then Save.

AI Model

What it does Chooses which model the agent loop uses.

Default value Empty in settings; each provider has a built-in default if unset.

Available options

OpenAI:

Gemini:

Recommended configuration gpt-4o-mini or gemini-2.0-flash for cost and latency.

When to use it Match the models your API account can call.

Effect on the frontend Faster/cheaper models reply sooner. Quality of language varies; catalog facts still come from WooCommerce tools.

Dependencies Selected provider.

Important notes The agent loop is vendor-neutral. Tool names are the same for both providers.

Example OpenAI + GPT-4o mini for a mid-size catalog.

Temperature

What it does Controls how varied the model’s wording is. Lower values stay closer to catalog facts.

Default value 0.2

Available options 0 to 2, step 0.1.

Recommended configuration 0.2–0.4 for shopping assistants.

When to use it Raise slightly if replies feel robotic. Keep low if the model paraphrases product claims too freely.

Effect on the frontend Wording style only. Prices and stock still come from WooCommerce.

Dependencies AI provider.

Important notes Does not affect native (no-AI) catalog search.

Example Leave at 0.2 for a parts store that must not invent fitment.

Max Output Tokens

What it does Caps the length of a single model completion.

Default value 1024

Available options 64–32000

Recommended configuration 1024 is enough for chat plus tool calls. Increase if replies are cut off.

When to use it Long comparison explanations or verbose personas.

Effect on the frontend Truncated replies if the cap is too low.

Dependencies Provider token limits still apply.

Important notes This is model output, not the shopper’s input length (that is Maximum message length).

Example Keep 1024 unless you see cut-off answers.

Fallback provider (Advanced)

What it does Second provider used only for transport failures (timeouts, HTTP 5xx), not for a bad model answer.

Default value None (— None —).

Available options None, OpenAI, Gemini.

Recommended configuration None unless you maintain two keys.

When to use it Primary outage resilience.

Effect on the frontend Shoppers may wait longer on a failover, then still get a reply.

Dependencies A stored (or constant) key for the fallback provider.

Important notes Semantic errors (content filter, empty text) do not trigger fallback.

Example Primary OpenAI, fallback Gemini, both keys in wp-config.php.

Request timeout (seconds) (Advanced)

What it does HTTP timeout for provider calls.

Default value 30

Available options 5–120

Recommended configuration 30.

When to use it Slow hosts or large tool loops.

Effect on the frontend On timeout, the plugin falls back to catalog search / fallback messages rather than hanging forever.

Dependencies Filter aiwsa_provider_timeout can override.

Important notes Product Search has a separate AI request timeout that can override this for intent parsing only.

Example A shared host with slow DNS might use 45.

Custom base URL (Advanced)

What it does Optional HTTPS endpoint override. Must be on an allowed host unless local hosting is enabled.

Default value Empty (official provider URL).

Available options HTTPS URL. Allow-listed hosts by default:

• api.openai.com
• api.anthropic.com
• generativelanguage.googleapis.com
• openrouter.ai

Filter: aiwsa_provider_allowed_hosts.

Recommended configuration Leave empty.

When to use it A compatible proxy on an allowed host.

Effect on the frontend None directly. Wrong URL → API errors → fallback copy.

Dependencies reject_unsafe_urls, no redirects, SSL verify.

Important notes Listing Anthropic/OpenRouter hosts does not ship those adapters.

Example Empty field for standard OpenAI.

Allow a local, self-hosted provider (Advanced)

What it does Narrowly permits one host and port for a model running on this machine (for example a local OpenAI-compatible server).

Default value Off.

Available options On / Off.

Recommended configuration Off on public production stores.

When to use it Development or a locked-down self-hosted model.

Effect on the frontend Only if the primary provider is pointed at that host.

Dependencies Custom base URL + this toggle.

Important notes This is an SSRF exception. Keep it off unless you understand the risk.

Example A developer testing against localhost with the toggle on.