=== VidFlow AI ===
Contributors: vidflowai, paulprov
Donate link: https://wise.com/pay/me/paulp340
Tags: ai, video, generate, gutenberg, youtube
Requires at least: 6.2
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Generate, manage, embed, and publish AI videos from WordPress using your own provider API credentials (BYOK).

== Description ==

VidFlow AI connects WordPress directly to supported AI video providers. You supply provider credentials and pay that provider for any required credits. VidFlow AI supplies generation controls, background status checks, a video library, embeds, downloads, optional local storage, and YouTube publishing.

Bundled providers are Kling AI and Hailuo AI / MiniMax. New Kling connections and generations use Kling API 2.0 with one API key. Completed videos stay provider-hosted by default; local Media Library storage is optional.

**Free features**

* Text-to-video plus supported Start Frame and End Frame workflows
* Kling 3.0 and 2.6, plus current Hailuo / MiniMax models
* Standalone Create Video page and Gutenberg sidebar
* Video Library with titles, filters, previews, thumbnails, retries, downloads, embeds, and delete confirmation
* Gutenberg block and shortcode embeds
* Background generation polling with Action Scheduler when available and WP-Cron fallback
* Optional protected Media Library copies with signed playback and download URLs
* YouTube OAuth, resumable uploads, publishing defaults, history, retries, and published links
* Encrypted connector credentials, completion audio, privacy controls, and uninstall cleanup

VidFlow Pro is a separate add-on for workflow tools such as Projects, reusable assets, tracked batch runs, and merged videos. Bundled provider access remains in Free.

== External Services ==

External requests occur only after you configure or use the related feature. The bundled workflow sends requests from your WordPress site directly to the selected service; VidFlow AI does not use a hosted credential, credit, generation, or publishing relay.

**Kling AI (Kuaishou)**

Used to validate credentials, submit generations, poll status, and retrieve generated media URLs. New requests use `https://api-singapore.klingai.com`; legacy jobs may continue polling at `https://api.klingai.com`.

Connection tests send your API key and a bounded account-usage date range without generating a video. Generations send your API key, prompt, model/settings, and supplied frame data. Status checks send credentials and the saved task ID. Kling may return usage data, task status, errors, and hosted media URLs.

Terms: https://kling.ai/docs/user-policy | Privacy: https://kling.ai/docs/privacy-policy | API terms: https://kling.ai/document-api/protocols/paidServiceProtocol | API privacy: https://kling.ai/document-api/protocols/privacyPolicy

**Hailuo AI / MiniMax**

Used to validate credentials, submit generations, poll status, and retrieve media URLs through `https://api.minimax.io`. Requests may send your credential, prompt, model/settings, supplied frame URL or data, and saved task ID. MiniMax may return task status, errors, and hosted media URLs.

Terms: https://www.minimax.io/terms-of-service-v2.html | Privacy: https://www.minimax.io/privacy-policy-v2.html | Hailuo terms: https://hailuoai.video/doc/terms-of-service.html | Hailuo privacy: https://hailuoai.com/doc/privacy-policy.html

**Google OAuth and YouTube**

Used only when you configure and connect YouTube or queue a completed video for publishing. OAuth uses `https://accounts.google.com` and `https://oauth2.googleapis.com`; channel checks and uploads use `https://www.googleapis.com`.

Connection sends your OAuth client details, authorization code, redirect URI, requested scopes, and tokens as required by Google. Publishing sends the chosen video's bytes, title, description, tags, category, and visibility. Google may return channel details, tokens, upload status, errors, and video URLs. Refresh tokens are encrypted in WordPress.

YouTube terms: https://www.youtube.com/t/terms | Google privacy: https://policies.google.com/privacy | YouTube API terms: https://developers.google.com/youtube/terms/api-services-terms-of-service

**Provider-hosted media and remote frames**

Preview, download, proxy, validation, thumbnail, or optional import actions may make HEAD or GET requests from your WordPress server to the exact provider media or remote frame URL. These requests expose normal HTTP metadata, including your server IP and the requested URL, to that host. VidFlow AI does not add WordPress account data or plugin settings to media fetches.

Provider media is governed by the selected provider's terms and privacy policy above. No analytics, tracking, or VidFlow-hosted telemetry request is sent by the plugin.

== Installation ==

1. Install VidFlow AI through WordPress or upload it to `/wp-content/plugins/vidflow-ai/`.
2. Activate the plugin.
3. Open VidFlow AI > Settings and save credentials for a supported provider.
4. Optionally connect YouTube or enable local Media Library storage.
5. Create a video, then preview, download, embed, or publish it from Video Library.

== Frequently Asked Questions ==

= Is VidFlow AI Free really free? =

Yes. Provider integrations and core WordPress workflows are included. You need your own provider account and pay that provider for any required credits or API usage.

= Where are completed videos stored? =

Provider-hosted by default. Enable Media Library storage only when you want protected local copies. Downloads can use the provider URL when no local copy exists.

= How are credentials protected? =

Saved provider and OAuth secrets are encrypted in WordPress. Limit administrator access and secure your site, database, backups, and encryption keys.

= Does work continue after I leave the page? =

Yes. Generation polling and YouTube uploads use background jobs. Action Scheduler is preferred where supported; WP-Cron is the fallback, so reliable site cron improves processing.

= Can editors embed videos? =

Administrators manage generation, settings, the shared library, and publishing. Users who can edit posts can use the VidFlow embed block or shortcode with shared completed videos.

= What happens if generation fails? =

The Library shows the provider error when available. Confirm credentials, credits, model compatibility, frame access, and cron health before retrying. A retry may consume provider credits.

== Screenshots ==

1. Create a video with provider-specific controls and optional Start or End Frames.
2. Manage matching completed-video titles, thumbnails, previews, downloads, embeds, and publishing actions in Video Library.
3. Configure Kling API 2.0, Hailuo / MiniMax, YouTube, media, notification, and privacy settings.
4. Publish completed videos and review destination status in Publishing Activity.
5. Embed completed videos with the Gutenberg block or shortcode.

== Upgrade Notice ==

= 1.1.0 =
Moves new Kling connections, Kling 3.0 and 2.6 generations, and retries to API 2.0 with one API key. Existing legacy jobs keep polling. Adds YouTube publishing, browser thumbnails, provider-hosted defaults, refreshed workflows, and security hardening.

== Changelog ==

= 1.1.0 =
* Added Kling API 2.0 support using one API key for connection tests, Kling 3.0 and 2.6 generations, retries, and polling; tests validate account access without generating a video, and legacy jobs keep polling while AK/SK users migrate.
* Added free YouTube publishing with Google OAuth, resumable background uploads, destination defaults, retry controls, publishing history, and stored public links.
* Added published-destination playback and browser thumbnails from Start Frames or proxied provider video frames.
* Kept completed videos provider-hosted by default, with optional protected Media Library copies and short-lived signed local playback URLs.
* Refreshed Create Video, Video Library, Publishing Activity, Settings, preview, and publishing interfaces with clearer titles, filters, status, pagination, and accessible dialogs.
* Updated Hailuo models and generation defaults.
* Improved generation, retry, and polling reliability so invalid requests stop before an unintended provider request.
* Improved YouTube queue state, resumable uploads, connection handling, and retry behavior.
* Improved provider-hosted playback, downloads, thumbnails, and optional local imports.
* Preserved valid provider credential characters, masked saved secrets, bounded provider polling, and redacted secret-bearing provider data from diagnostic logs.
* Prevented protected embeds from exposing provider URLs and hardened proxied downloads with WordPress safe HTTP requests.
