Connection and API keys

Open Settings in the builder header, then the Connection tab. This is where the app’s link to your site lives, and where you see which optional services are configured.

The WordPress connection

The panel shows which user the app is connected as, and the version of the Memberside plugin answering on your site.

To change the site, rotate the application password, or reconnect after revoking one, connect again from here. See Connect your WordPress site.

If the plugin cannot be found, this panel says so and links to the plugin’s own admin screen, at /wp-admin/admin.php?page=memberside-keys on your site.

Where API keys actually live

Keys are stored on your site, not in Memberside

Push credentials, Turnstile secrets, Maps keys, in-app purchase keys and every social sign-in credential are held by the Memberside plugin on your own WordPress install, under Memberside → API Keys. The builder reads only whether each one is present. The values never reach Memberside’s servers and are never returned by the API.

This is why the Connection tab shows availability rather than fields to paste secrets into. A secret you can read back from a hosted builder is a secret you have to trust the builder with.

Set them in WordPress under Memberside → API Keys. Each can also be defined as a PHP constant in wp-config.php, which takes precedence over the stored value — useful when your keys belong in deployment configuration rather than in a database. The screen offers both, per key, and shows you the define() line to paste.

wp-config.php is the safer of the two. A value there is not in your database backups, is not copied into staging clones, and cannot be read by other plugins.

A few keys hold a file rather than a string — the Apple .p8 keys, the Firebase service account, the Play service account, google-services.json, the iOS distribution certificate and profile, the Android upload keystore. Set as a constant, those hold an absolute path to the file. Stored in the database, they hold the contents. This applies to the Apple social sign-in key too.

Every one of them has a “Choose file” button beside its value. Pick the file Google or Apple gave you and the screen does the rest: bound for wp-config.php, your site saves it into a private folder it never serves and writes that path into the constant. You never need to upload a credential to your server by hand or type its path. The field then shows the file’s name rather than its contents, because a 2 KB service account in a one-line input is not something anyone can check.

What you can configure

The API Keys screen shows one card per integration. They are listed here in the same order.

Cloudflare Turnstile

Key	Used for
Turnstile site key	The challenge on any sign-in, registration or password-reset screen
Turnstile secret key	Verifying that challenge, on your site

The site key is public and is compiled into your app — read from your site each time you build, so adding it needs a rebuild before the challenge appears. The secret key never leaves your server. We store neither. With only the site key set, the challenge renders and every verification fails.

Once a secret is set, this card also carries Require the challenge. It is on unless you turn it off, and it refuses any sign-in, registration or password reset that arrives without a solved challenge. With Memberside 2.38.0 or later it is only the fallback: saving an app in the builder sends its per-feature Turnstile switches to your site, and those decide for that app. The switch covers what is left — apps built before the update, and forms an app has not placed. Each app’s per-form choices are listed under it, read-only; change them in the builder. A token that is sent is always checked, whichever way the switch is set.

Firebase Cloud Messaging

Key	Used for
Firebase service account	Push notifications to Android
Firebase Android config	The google-services.json, so builds can initialise Firebase
Firebase server key	Push notifications, the legacy method for projects created before mid-2024

Apple Push Notifications

Key	Used for
Apple push key (.p8), key ID, team ID, bundle ID	Push notifications to iOS

OneSignal

Key	Used for
OneSignal App ID and REST API key	An alternative push provider, not used by the Push service

In-app purchases

Key	Used for
App Store Connect API key (.p8), key ID, issuer ID	Verifying purchases with Apple
Google Play service account	Verifying purchases with Google Play

The App Store Connect key is not the push key

Both are .p8 files from Apple, both come with a key ID, and they are not interchangeable. A push key used here fails in a way that reads as a typo in the credential rather than as the wrong credential.

These four are only half of what in-app purchases need. Your bundle ID, package name and the mapping from products to store identifiers live on a different screen, Memberside → In-App Purchases. See Setting up in-app purchases.

Google Maps Platform

Key	Used for
Google Maps API key	The interactive map pages your site serves and the small map images. Also address search and job locations, until you add a server key
Google Maps server key (optional)	Address search, place lookups and job locations, called by your site itself
Google Maps SDK key (Android)	A native map inside your Android app — the Members Map screen and the Jobs map view
Google Maps SDK key (iOS)	The same screens inside your iPhone app

The map in the builder preview is ours

You do not need a Google account to lay out a map screen. The builder draws the preview’s map with Memberside’s own key, so the Members Map and the Jobs map view show real tiles from the moment you place them.

That is the preview only. Your app needs your own SDK keys, and this is not a policy we chose: Google bills the Maps SDK per app install and ties a key to one app’s package name or bundle ID and signing certificate, so no key of ours can sign your app’s map. A key on this screen is the app’s map; a key here is not needed for the preview.

Four Maps keys, and none of them are interchangeable

The Google Maps API key is restricted by HTTP referrer and is only ever loaded by pages your site serves. The server key is restricted by IP address and never leaves your site. The two SDK keys are compiled into the app, so restricting each one is what protects it, rather than keeping it hidden.

The two SDK keys have to be two keys. A Google Cloud key takes exactly one application restriction — “Android apps” or “iOS apps” — so one key cannot be restricted to both platforms. A single key serving both can only be an unrestricted key, which is the one kind worth stealing out of an app anyone can download.

They also need different APIs enabled: Maps JavaScript API and Static Maps on the Google Maps API key, Places API and Geocoding API on the server key, Maps SDK for Android on the Android key, Maps SDK for iOS on the iOS key. Without a server key, the Google Maps API key needs Places and Geocoding too. Using the Google Maps API key in the app produces a grey tile and no error message anyone can see.

If you already had a single mobile SDK key, it is now your iOS key and keeps working on both platforms until you add an Android key. Adding the second key is what lets you restrict either of them.

Why there is a server key. Your map pages need a key restricted by HTTP referrer, because a browser loads them. Google refuses that same key for the lookups your site makes itself: address search, place details, and turning a map pin into an address. Your site sends no referrer for those, so no referrer-restricted key can ever pass. One key cannot do both jobs.

So add a second key as the Google Maps server key:

1. Create a new API key in the same Google Cloud project.
2. Enable the Places API and the Geocoding API on it.
3. Restrict it by IP address, to your web server’s public address.
4. Paste it into Google Maps server key on the Google Maps card.

Your site then uses the server key for every lookup and the Google Maps API key only for the maps it serves. The server key is never placed in a page or an image link. Leave the Google Maps API key restricted by referrer.

Without a server key, the app still works around a referrer-restricted key. Location fields search for an address and show their map inside your site’s own map page, where Google accepts that key, and the Google Maps card says your site is relying on this. A job posted with a map pin still saves with its pin and the address the member typed, but without a city, state or country, so it does not match a place filter. The server key fixes both.

A server key on its own draws no map. Every map page needs the Google Maps API key, so set that one first.

Social Login

Two to four credentials per provider, across nineteen providers, in one card with a collapsed section each. Each section shows the redirect URL to register with that provider, with a copy button.

Which providers exist and what each one needs is in Social sign-in.

Other keys

Only appears when another plugin has registered a key of its own.

Push notifications

Push needs two things, and credentials are only the first:

1. Credentials here — an Apple push key for iOS, a Firebase service account for Android, or both. The Connection tab reports which it found.
2. The Push service connected, under Memberside → Services. See Push.

Your push keys never leave your server

This is worth stating plainly, because it is stronger than the promise the rest of this page makes.

Your .p8 and your Firebase service account are not uploaded anywhere. Your own site uses them to sign a token that lasts about an hour, and only that short-lived token is sent onward to do the delivering. So deleting a key on this screen genuinely revokes it — there is no copy of it elsewhere to withdraw, and nothing to ask us to do.

The four Apple fields go together. A .p8 without its key ID, team ID and bundle ID cannot be presented to Apple, and the services panel reports the integration as unconfigured until all four are set.

Push cannot be tested in the preview. It only exists in a compiled app on a real device, and only in a build made after the credentials were added — the Firebase identifiers and the bundle ID are compiled into the app.

When it does not work

Symptom	Cause	Fix
The connection panel says the plugin was not found	The plugin is inactive, or the site URL is wrong	Install the plugin
A key you set is reported as absent	It was saved empty, or saved on a different site	Re-enter it under Memberside → API Keys
A key set in wp-config.php seems ignored	A constant overrides the stored value, not the reverse	Check the constant’s spelling; it wins when defined
A pasted .p8 reports as unreadable	It was pasted without its -----BEGIN----- and -----END----- lines, so it looks like a file path	Paste the whole file, or give an absolute path to it
Push keys are set but nothing sends	The Push service is not connected	Connect it under Memberside → Services
Turnstile passes in preview but fails in the app	The secret key is missing on the site	The site verifies the challenge, so it needs the secret half
The build fails asking for the Turnstile site key	The capabilities endpoint is off, so the build cannot read it	Enable the Site group under Memberside → REST API
A Turnstile key was added but the app shows no challenge	The site key is compiled in at build time	Build again
A constant written from this screen still reads as unset	Constants are only visible on the next request	Press Check again
The map screen shows a grey tile	The Google Maps API key was used instead of an SDK key, or that platform’s SDK key is not set	Set Google Maps SDK key (Android) and (iOS) and rebuild
The map is fine in the builder and empty in the app	The builder’s map is ours; the app’s is yours	Set the two SDK keys above and rebuild. The map screen falls back to its member list when no map appears, so the screen still works while you sort the key out
The Google Maps card says address search runs in your site’s map page	The key is restricted by HTTP referrer, which Google refuses for server-side lookups	Add a Google Maps server key restricted by IP address. Keep the referrer-restricted key for your site’s maps
The Google Maps card says Google refuses the server key	The server key is restricted by HTTP referrer too	Restrict the server key by IP address instead
Posted jobs have a pin but no city or country	Google refused the address lookup, so the job kept only its pin and typed address	Add a Google Maps server key. Jobs posted after that are filed under their city and country
Address search and job locations work, but no map appears anywhere	Only the server key is set	Set the Google Maps API key as well. The server key is never used to draw a map
Turnstile is off on a feature and members are still asked for a token	The app has not been saved since, the site runs Memberside older than 2.38.0, or the installed app predates it	Save the app, update Memberside and rebuild, or turn Require the challenge off
In-app purchases refuse every receipt	The APNs key was pasted as the App Store Connect key	They are different keys; use the App Store Connect one
A social provider is absent from the app	Its credentials are incomplete	Fill in every required field for it

Next

The launcher screen.