Kit · n7studios · Oct 17, 2025 · Sep 30, 2025 · Oct 16, 2025 · Oct 16, 2025
diff --git a/.env.example b/.env.example
@@ -2,6 +2,11 @@ CONVERTKIT_OAUTH_ACCESS_TOKEN=
 CONVERTKIT_OAUTH_REFRESH_TOKEN=
 CONVERTKIT_OAUTH_ACCESS_TOKEN_NO_DATA=
 CONVERTKIT_OAUTH_REFRESH_TOKEN_NO_DATA=
+CONVERTKIT_V4_API_KEY=
+CONVERTKIT_V3_API_KEY=
+CONVERTKIT_V3_API_SECRET=
+CONVERTKIT_V3_API_KEY_NO_DATA=
+CONVERTKIT_V3_API_SECRET_NO_DATA=
 CONVERTKIT_OAUTH_CLIENT_ID=
 CONVERTKIT_OAUTH_CLIENT_SECRET=
 CONVERTKIT_OAUTH_REDIRECT_URI="https://convertkit-github.local/wp-admin/options-general.php?page=_wp_convertkit_settings"

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -38,6 +38,21 @@ jobs:
           php-version: ${{ matrix.php-versions }}
           coverage: none
 
+      # Exchange API Keys and Secrets for OAuth Tokens.
+      - name: Exchange API Key and Secret for OAuth Tokens
+        id: get-oauth-tokens
+        run: |
+          response=$(curl -s -X POST "${{ secrets.CONVERTKIT_EXCHANGE_API_KEYS_ENDPOINT }}?api_key=${{ secrets.CONVERTKIT_V3_API_KEY }}&api_secret=${{ secrets.CONVERTKIT_V3_API_SECRET }}&client_id=${{ secrets.CONVERTKIT_OAUTH_CLIENT_ID }}&redirect_uri=${{ secrets.CONVERTKIT_OAUTH_REDIRECT_URI }}&tenant_name=github-actions-${{ steps.test-group.outputs.value }}-${{ matrix.php-versions }}")
+          access_token=$(echo "$response" | jq -r '.oauth.access_token')
+          refresh_token=$(echo "$response" | jq -r '.oauth.refresh_token')
+          echo "KIT_OAUTH_ACCESS_TOKEN=$access_token" >> $GITHUB_ENV
+          echo "KIT_OAUTH_REFRESH_TOKEN=$refresh_token" >> $GITHUB_ENV
+          response=$(curl -s -X POST "${{ secrets.CONVERTKIT_EXCHANGE_API_KEYS_ENDPOINT }}?api_key=${{ secrets.CONVERTKIT_V3_API_KEY_NO_DATA }}&api_secret=${{ secrets.CONVERTKIT_V3_API_SECRET_NO_DATA }}&client_id=${{ secrets.CONVERTKIT_OAUTH_CLIENT_ID }}&redirect_uri=${{ secrets.CONVERTKIT_OAUTH_REDIRECT_URI }}&tenant_name=github-actions-${{ steps.test-group.outputs.value }}-${{ matrix.php-versions }}")
+          access_token=$(echo "$response" | jq -r '.oauth.access_token')
+          refresh_token=$(echo "$response" | jq -r '.oauth.refresh_token')
+          echo "KIT_OAUTH_ACCESS_TOKEN_NO_DATA=$access_token" >> $GITHUB_ENV
+          echo "KIT_OAUTH_REFRESH_TOKEN_NO_DATA=$refresh_token" >> $GITHUB_ENV
+
       # Write any secrets, such as API keys, to the .env.dist.testing file now.
       # Make sure your committed .env.dist.testing file ends with a newline.
       # The formatting of the contents to include a blank newline is deliberate.
@@ -47,11 +62,11 @@ jobs:
           path: .env.dist.testing
           contents: |
 
-            CONVERTKIT_OAUTH_ACCESS_TOKEN=${{ secrets.CONVERTKIT_OAUTH_ACCESS_TOKEN }}
-            CONVERTKIT_OAUTH_REFRESH_TOKEN=${{ secrets.CONVERTKIT_OAUTH_REFRESH_TOKEN }}
-            CONVERTKIT_OAUTH_ACCESS_TOKEN_NO_DATA=${{ secrets.CONVERTKIT_OAUTH_ACCESS_TOKEN_NO_DATA }}
-            CONVERTKIT_OAUTH_REFRESH_TOKEN_NO_DATA=${{ secrets.CONVERTKIT_OAUTH_REFRESH_TOKEN_NO_DATA }}
-            CONVERTKIT_API_KEY=${{ secrets.CONVERTKIT_API_KEY }}
+            CONVERTKIT_OAUTH_ACCESS_TOKEN=${{ env.KIT_OAUTH_ACCESS_TOKEN }}
+            CONVERTKIT_OAUTH_REFRESH_TOKEN=${{ env.KIT_OAUTH_REFRESH_TOKEN }}
+            CONVERTKIT_OAUTH_ACCESS_TOKEN_NO_DATA=${{ env.KIT_OAUTH_ACCESS_TOKEN_NO_DATA }}
+            CONVERTKIT_OAUTH_REFRESH_TOKEN_NO_DATA=${{ env.KIT_OAUTH_REFRESH_TOKEN_NO_DATA }}
+            CONVERTKIT_V4_API_KEY=${{ secrets.CONVERTKIT_V4_API_KEY }}
             CONVERTKIT_OAUTH_CLIENT_ID=${{ secrets.CONVERTKIT_OAUTH_CLIENT_ID }}
             CONVERTKIT_OAUTH_CLIENT_SECRET=${{ secrets.CONVERTKIT_OAUTH_CLIENT_SECRET }}
             CONVERTKIT_OAUTH_REDIRECT_URI=${{ secrets.CONVERTKIT_OAUTH_REDIRECT_URI }}
@@ -71,7 +86,6 @@ jobs:
 
       # Run PHPStan for static analysis.
       - name: Run PHPStan Static Analysis
-        working-directory: ${{ env.PLUGIN_DIR }}
         run: php vendor/bin/phpstan analyse --memory-limit=1250M
 
       # Run Coding Standards.

diff --git a/SETUP.md b/SETUP.md
@@ -38,24 +38,7 @@ If you're new to this, use [GitHub Desktop](https://desktop.github.com/) or [Tow
 
 ### Configure Testing Environment
 
-Copy the `.env.example` file to `.env` in the root of this repository, adding your ConvertKit API keys.
-
-```
-CONVERTKIT_API_KEY_NO_DATA=
-CONVERTKIT_API_SECRET_NO_DATA=
-CONVERTKIT_API_KEY=
-CONVERTKIT_API_SECRET=
-CONVERTKIT_API_BROADCAST_ID="8697158"
-CONVERTKIT_API_FORM_ID="2765139"
-CONVERTKIT_API_LEGACY_FORM_URL="https://app.convertkit.com/landing_pages/470099"
-CONVERTKIT_API_LANDING_PAGE_URL="https://cheerful-architect-3237.ck.page/cc5eb21744"
-CONVERTKIT_API_LEGACY_LANDING_PAGE_URL="https://app.convertkit.com/landing_pages/470103"
-CONVERTKIT_API_SEQUENCE_ID="1030824"
-CONVERTKIT_API_TAG_NAME="wordpress"
-CONVERTKIT_API_TAG_ID="2744672"
-CONVERTKIT_API_SUBSCRIBER_EMAIL="optin@n7studios.com"
-CONVERTKIT_API_SUBSCRIBER_ID="1579118532"
-```
+Copy the `.env.example` file to `.env` in the root of this repository, adding your Kit API keys.
 
 #### PHPStan
 

diff --git a/tests/ConvertKitAPIKeyTest.php b/tests/ConvertKitAPIKeyTest.php
@@ -31,7 +31,7 @@ protected function setUp(): void
 
         // Setup API instances.
         $this->api = new ConvertKit_API(
-            apiKey: $_ENV['CONVERTKIT_API_KEY']
+            apiKey: $_ENV['CONVERTKIT_V4_API_KEY']
         );
 
         // Wait a second to avoid hitting a 429 rate limit.
@@ -49,7 +49,7 @@ public function testDebugEnabled()
     {
         // Setup API with debugging enabled.
         $api = new ConvertKit_API(
-            apiKey: $_ENV['CONVERTKIT_API_KEY'],
+            apiKey: $_ENV['CONVERTKIT_V4_API_KEY'],
             debug: true
         );
 
@@ -75,7 +75,7 @@ public function testDebugEnabledWithCustomLogFile()
 
         // Setup API with debugging enabled.
         $api = new ConvertKit_API(
-            apiKey: $_ENV['CONVERTKIT_API_KEY'],
+            apiKey: $_ENV['CONVERTKIT_V4_API_KEY'],
             debug: true,
             debugLogFileLocation: $this->logFile
         );
@@ -101,21 +101,21 @@ public function testDebugCredentialsAndEmailsAreMasked()
     {
         // Setup API with debugging enabled.
         $api = new ConvertKit_API(
-            apiKey: $_ENV['CONVERTKIT_API_KEY'],
+            apiKey: $_ENV['CONVERTKIT_V4_API_KEY'],
             debug: true
         );
 
         // Create log entries with API Key and Email Address, as if an API method
         // were to log this sensitive data.
-        $this->callPrivateMethod($api, 'create_log', ['API Key: ' . $_ENV['CONVERTKIT_API_KEY']]);
+        $this->callPrivateMethod($api, 'create_log', ['API Key: ' . $_ENV['CONVERTKIT_V4_API_KEY']]);
         $this->callPrivateMethod($api, 'create_log', ['Email: ' . $_ENV['CONVERTKIT_API_SUBSCRIBER_EMAIL']]);
 
         // Confirm that the log includes the masked API Key and Email Address.
         $this->assertStringContainsString(
             str_repeat(
                 '*',
-                (strlen($_ENV['CONVERTKIT_API_KEY']) - 4)
-            ) . substr($_ENV['CONVERTKIT_API_KEY'], -4),
+                (strlen($_ENV['CONVERTKIT_V4_API_KEY']) - 4)
+            ) . substr($_ENV['CONVERTKIT_V4_API_KEY'], -4),
             $this->getLogFileContents()
         );
         $this->assertStringContainsString(
@@ -124,7 +124,7 @@ public function testDebugCredentialsAndEmailsAreMasked()
         );
 
         // Confirm that the log does not include the unmasked API Key or Email Address.
-        $this->assertStringNotContainsString($_ENV['CONVERTKIT_API_KEY'], $this->getLogFileContents());
+        $this->assertStringNotContainsString($_ENV['CONVERTKIT_V4_API_KEY'], $this->getLogFileContents());
         $this->assertStringNotContainsString($_ENV['CONVERTKIT_API_SUBSCRIBER_EMAIL'], $this->getLogFileContents());
     }
 
@@ -158,7 +158,7 @@ public function testRequestHeadersMethod()
         $this->assertEquals($headers['Accept'], 'application/json');
         $this->assertEquals($headers['Content-Type'], 'application/json; charset=utf-8');
         $this->assertEquals($headers['User-Agent'], 'ConvertKitPHPSDK/' . $this->api::VERSION . ';PHP/' . phpversion());
-        $this->assertEquals($headers['X-Kit-Api-Key'], $_ENV['CONVERTKIT_API_KEY']);
+        $this->assertEquals($headers['X-Kit-Api-Key'], $_ENV['CONVERTKIT_V4_API_KEY']);
     }
 
     /**
@@ -181,7 +181,7 @@ public function testRequestHeadersMethodWithType()
         $this->assertEquals($headers['Accept'], 'text/html');
         $this->assertEquals($headers['Content-Type'], 'text/html; charset=utf-8');
         $this->assertEquals($headers['User-Agent'], 'ConvertKitPHPSDK/' . $this->api::VERSION . ';PHP/' . phpversion());
-        $this->assertEquals($headers['X-Kit-Api-Key'], $_ENV['CONVERTKIT_API_KEY']);
+        $this->assertEquals($headers['X-Kit-Api-Key'], $_ENV['CONVERTKIT_V4_API_KEY']);
     }
 
     /**