Your WordPress snippets just learned to answer the phone.

SnipVault 1.3.2 introduces Snippet Functions — a way to expose any published PHP snippet as a signed, authenticated HTTP endpoint on your site. That means your snippets aren't just code that runs on page load anymore. They can receive incoming webhooks from Stripe, GitHub, Zapier, n8n, or anything else that can fire an HTTP request.

This is, as far as we know, a first for the WordPress snippet manager category. No other snippet plugin lets you go from "I wrote a PHP snippet" to "it's a live, secured API endpoint" in a single toggle.

How Snippet Functions Work

Publish a snippet, flip it to a Function, and it's immediately reachable at a clean URL:

https://yoursite.com/sv/your-slug

Or via the REST API fallback at /snipvault/v1/functions/{slug}/invoke.

Every function comes with the infrastructure you'd expect from a proper webhook receiver:

• Secret-header authentication — callers must include your secret in the request headers. No secret, no execution.

• Rate limiting — built in at the endpoint level so a misconfigured sender can't hammer your site.

• Invocation logs — the last 50 calls are stored with status, timing, and payload data, visible right from the dashboard.

• Admin replay — re-fire any successful or test invocation with one click to debug or re-process.

• Dashboard telemetry — see call volume, success/failure rates, and response times at a glance.

The security model is intentionally tight. Replay is restricted to successful and test invocations only — failed auth bodies aren't stored. GitHub imports can't silently enable a function or plant a secret. Capability-based auth is POST-only. Rate limits apply after authentication, not before. And settings saves are validated to prevent weak secrets.

Snippet Engineer Can Build Them Too

The AI-powered Snippet Engineer now has two new tools: expose_as_function and test_function, along with a built-in webhook recipe. That means you can describe what you need — "create a webhook that receives a Stripe payment event and logs the customer email" — and the agent will author the snippet, write fixture tests, and deploy the endpoint. All without leaving the SnipVault interface.

Everything Else in 1.3.2

GitHub Sync reliability overhaul. OAuth tokens that expired after ~8 hours are now refreshed automatically before API calls, with a single retry on 401. Tokens have also been moved to their own dedicated option key, so saving unrelated settings can no longer accidentally wipe your GitHub connection. And the GitHub Library no longer 404s when your configured base path doesn't exist yet — it returns an empty list gracefully instead.

Portable snippet storage. Snippet file paths are now stored as uploads-relative paths (snipvault/slug_123.php) instead of absolute filesystem paths. Migrate hosts, change server configs, move your uploads directory — your snippets keep working. Existing absolute paths are remapped at runtime and rewritten on the next upgrade.

UI fix for project cards. Cards no longer render with dark-only colors when you're in light mode. They now share the same surface, text, and footer treatments as automation cards across both themes.

Update Now

SnipVault 1.3.2 is available now. Update from your WordPress dashboard or download from your account.

If you've been duct-taping together webhook receivers with custom plugins or functions.php hacks — this one's for you.