🔐 How to Access the WooCommerce REST API Using API Keys

Want to pull products, create orders, or sync data with your WooCommerce store from another app? You’re going to need access to the WooCommerce REST API—and you’ll need credentials to use it.

This tutorial covers everything from turning the API on to calling it with real credentials.

🧰 What You’ll Need

A WooCommerce store (obviously!)
Admin access to WordPress
A WordPress user account with proper permissions (admin/shop manager)
A REST client (like Postman, cURL, or custom code)

🛠️ Step 1: Confirm the REST API is Active

✅ Check if the API responds:

Go to this in your browser:

https://yourstore.com/wp-json/

You should see a JSON blob like this:

{
  "name": "My Store",
  "description": "A great WooCommerce store",
  ...
}

If that works, your REST API is active.

🧩 Step 2: Enable Pretty Permalinks

WooCommerce REST API requires pretty permalinks.

Go to:

WordPress Admin → Settings → Permalinks

Select anything other than “Plain”, like Post name, and click Save Changes.

🧪 Step 3: Try Accessing a WooCommerce Endpoint (Fail Expected)

Try:

https://yourstore.com/wp-json/wc/v3/products

You’ll likely see:

{
  "code": "woocommerce_rest_cannot_view",
  "message": "Sorry, you cannot list resources.",
  "data": { "status": 401 }
}

Yup, this means you need authentication. Time to get some keys!

🔑 Step 4: Create WooCommerce API Keys

Go to:

WooCommerce → Settings → Advanced → REST API

Then:

Click Add Key
Fill in:
- Description: e.g., API Access for Mobile App
- User: select a user with appropriate permissions (Admin or Shop Manager)
- Permissions: choose Read or Read/Write
Click Generate API Key

💾 Save the Consumer Key and Consumer Secret.

🚀 Step 5: Call the API with Your Credentials

You’ve got two main ways to call the API: Basic Auth or query parameters.

Option 1: 🔐 Use Basic Auth (Recommended)

In Postman or your code:

Username = Consumer Key
Password = Consumer Secret

Request:

GET https://yourstore.com/wp-json/wc/v3/products

You’ll now get real product data!

Option 2: 😬 Use Query Parameters (For Testing Only)

Request:

https://yourstore.com/wp-json/wc/v3/products?consumer_key=ck_123&consumer_secret=cs_456

Replace the keys with your actual ones. This works, but don’t use it in production, as it exposes credentials in the URL.

🔎 Bonus: Example JSON Response

A successful call to /products might return:

[
  {
    "id": 101,
    "name": "Super Comfy Hoodie",
    "price": "29.99",
    "stock_quantity": 12,
    ...
  },
  ...
]

🧭 Next Steps

You’re now officially connected! Here’s what you can do next:

Endpoint	Purpose
`/orders`	View/Create orders
`/customers`	Manage customers
`/products`	Read or update products
`/coupons`	Manage discount codes

Want to do these things from JavaScript, Python, or a mobile app? I can help you set that up too.

✅ Recap

Step	Summary
API Access	Built into WooCommerce
Pretty Permalinks	Must be enabled
API Keys	Generate in WooCommerce settings
Authentication	Required for protected endpoints
Tools	Use Postman, cURL, or code

🎁 Bonus Goodies & Pro Tips for WooCommerce REST API

⚡ 1. Use `per_page` and Pagination Smartly

WooCommerce defaults to 10 results per page. Want more? Use the per_page parameter:

GET /wp-json/wc/v3/products?per_page=100

Need page 2?

GET /wp-json/wc/v3/products?per_page=100&page=2

🧠 Pro Tip: The max per page is usually 100, so for big product lists, loop through pages until you get an empty response.

🧊 2. Cache API Responses When Reading Data

If you’re building an app or syncing products, cache responses to avoid hammering the API (and slowing down your site).

Use local storage, Redis, or a simple file-based cache—especially for /products or /categories.

🛡️ 3. Protect Your API Keys

If you’re using API keys in code or front-end apps:

NEVER expose them in JavaScript that’s visible to the public.
Use a proxy server or backend API to keep keys hidden and secure.
Rotate keys regularly, and delete unused ones.

📦 4. Use Webhooks for Real-Time Updates

Don’t poll the API every minute for new orders! Use WooCommerce Webhooks.

Example: When an order is created, WooCommerce can automatically notify your app.

Setup:

WooCommerce → Settings → Advanced → Webhooks

Trigger types include:

Order Created
Product Updated
Customer Deleted

🧙 5. Use API to Automate Your Store

Think of your API like a personal store butler. You can:

Auto-create discount codes via /coupons
Sync inventory across platforms
Auto-archive out-of-stock items
Generate daily reports

🛠️ Combine with CRON jobs or scheduled tasks to make it run like a boss.

🔐 6. Switch to OAuth or JWT for Scalable Auth

API keys are fine for server-to-server. But for public or token-based apps, use:

OAuth 1.0a (built-in WooCommerce support)
Or integrate a JWT (JSON Web Token) plugin for token-based auth

Ask me and I can walk you through either setup!

🧾 7. Log Everything in Dev Mode

During development, log every request and response. This helps with:

Debugging permission errors
Analyzing API performance
Undoing accidental changes (oops!)

Use tools like:

Postman console
PHP logs with error_log()
Middleware in your app

💣 8. Use the “Batch” API for Bulk Actions

Want to update or delete a bunch of products/orders/customers at once?

Use WooCommerce’s batch endpoints:

POST /wp-json/wc/v3/products/batch

Payload:

{
  "update": [
    { "id": 123, "price": "19.99" },
    { "id": 124, "stock_quantity": 50 }
  ]
}

💡 This saves time and API calls. Great for syncing data from spreadsheets or ERPs.

Woo Rest API