OpenAI API Integration: Integrating the OpenAI API into Your WordPress Website

Integrating the OpenAI API into a WordPress site — for auto-generating content drafts, powering a chatbot, or summarizing comments — comes down to a straightforward pattern: a WordPress hook triggers a PHP function that calls the API and processes the response. Here’s the actual implementation.

Basic Setup: Calling the API from PHP

function call_openai_api($prompt) {
    $api_key = getenv('OPENAI_API_KEY'); // never hardcode the key in the theme/plugin file

    $response = wp_remote_post('https://api.openai.com/v1/chat/completions', [
        'headers' => [
            'Authorization' => 'Bearer ' . $api_key,
            'Content-Type'  => 'application/json',
        ],
        'body' => json_encode([
            'model' => 'gpt-4o-mini',
            'messages' => [['role' => 'user', 'content' => $prompt]],
        ]),
        'timeout' => 30,
    ]);

    if (is_wp_error($response)) {
        return null;
    }

    $body = json_decode(wp_remote_retrieve_body($response), true);
    return $body['choices'][0]['message']['content'] ?? null;
}

Using WordPress’s built-in wp_remote_post rather than raw cURL keeps the integration consistent with WordPress’s HTTP API conventions and error handling, including compatibility with any HTTP-request-modifying plugins already active on the site.

Storing the API Key Securely

Never hardcode an API key directly in a theme or plugin file — store it as an environment variable (via your hosting environment or a .env approach) or, at minimum, in wp-config.php as a defined constant outside the web root’s directly-served files. A hardcoded key in a plugin file risks exposure if that file is ever shared, version-controlled publicly, or exposed through a misconfiguration.

Common Integration Points

• Content drafting — hooking into the post editor to generate a first-draft outline or summary from a title.
• Automated excerpts — generating a post excerpt via the API when one isn’t manually written, hooked into save_post.
• Comment moderation assistance — flagging potentially problematic comments for review before they’re auto-approved.

Handling Costs and Rate Limits

Every API call costs money and counts against rate limits — for any integration triggered by regular site activity (not just manual admin actions), implement caching for repeated requests and set hard usage caps to avoid an unexpected bill from a traffic spike or a misbehaving loop triggering excessive calls.

Frequently Asked Questions

Should I call the API directly from the browser (JavaScript) instead of PHP?
No — calling directly from client-side JavaScript would expose your API key publicly in the page source; always proxy the request through your own server-side PHP code, which keeps the key server-side only.

Conclusion

OpenAI API integration into WordPress follows a standard pattern: a server-side PHP function using wp_remote_post, a securely stored API key never exposed client-side, and usage caps to control cost. The specific hook you attach it to depends on your use case, but the core request/response handling stays the same across integrations.