Free tools Windows power users keep installed
One-click scans. No signup required.
In WordPress, open WooCommerce > Settings > Advanced > REST API, select Add Key (shown as Create an API key in some current documentation), assign the key to a WordPress user, choose Read, Write, or Read/Write, and select Generate API Key. WooCommerce then displays a Consumer Key and Consumer Secret for the integration. Save both credentials immediately, because the secret is not available again after you leave the screen.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What a WooCommerce API key does
A WooCommerce REST API key lets an external application access store data through the WooCommerce API. The key is not a separate user account: it is attached to one WordPress user, and requests are limited by that user’s WordPress roles and capabilities as well as the key’s own Read/Write setting.
As an Amazon Associate I earn from qualifying purchases.
You normally create a key for an inventory synchronizer, reporting dashboard, fulfillment system, mobile app, or another service that needs programmatic access. The connected application also needs your store’s base URL and, depending on its setup, the API version and endpoint it will call.
The Consumer Key identifies the credential presented by the client, while the Consumer Secret proves that the client is authorized to use it. Neither value is a replacement for a human WordPress login. They are service credentials intended for an application-to-store connection, so give them only to the integration that needs them.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Prerequisites before creating the key
Use a working WordPress administrator session
Sign in to the WordPress dashboard with an account that can manage WooCommerce settings and REST API keys. If the REST API section or key controls are missing, ask a site administrator to grant the required administrative access rather than sharing an existing secret.
Check the permalink structure
WooCommerce’s REST API expects WordPress permalinks to use a human-readable structure. In Settings > Permalinks, do not leave the site on Plain permalinks when testing API routes. Save a non-Plain structure, then retry the request.
Decide which WordPress user should own the key
Choose a user whose capabilities match the integration’s job. A reporting service that only reads orders should not use a highly privileged administrator if a more narrowly capable account can do the work. Because the key follows that user’s permissions, changing the user’s role can change what the integration is able to do.
Document the owner as well as the connected service. If the owner is deactivated, deleted, or loses a capability, the integration may stop working or return fewer resources. The API reference specifically states that deleting the associated WordPress user makes the key stop functioning.
Plan a recognizable description
Use a description that identifies the connected system and purpose, such as Inventory sync, Warehouse fulfillment, or Reporting dashboard. A useful name makes it possible to identify the credential later when several integrations are listed and one needs to be revoked. Include an environment marker such as production or staging when the same service has separate installations.
Prepare secure transport
Plan to call the API over HTTPS. Basic Authentication sends the key and secret as credentials, so unencrypted HTTP is inappropriate for a live store. Local development with a self-signed certificate may require temporary client settings, but production requests should retain certificate verification.
Recommended Free Tools
Generate a key in the WordPress dashboard
- Open the dashboard. Sign in to the WordPress administrator area for the store.
- Open WooCommerce settings. Select WooCommerce > Settings.
- Open Advanced. Select the Advanced tab, then open the REST API section. Depending on the WooCommerce documentation or interface version, the control may be described as the REST API tab.
- Start key creation. Select Add Key. Some current merchant documentation labels the same action Create an API key.
- Enter a description. Identify the service, environment, and purpose. For example, use
Inventory sync - productioninstead of a generic name such asAPI key. - Select the user. Choose the WordPress user whose roles and capabilities should govern this integration.
- Choose permissions. Select the smallest scope that satisfies the application:
- Read permits retrieval of data.
- Write permits creating or updating data.
- Read/Write permits both retrieval and modification.
- Generate the credential. Select Generate API Key.
- Copy the displayed values. WooCommerce shows a Consumer Key and Consumer Secret. Enter them in the integration’s credential fields, together with the store URL if the integration requests it, before navigating away or closing the page.
“The Consumer Secret is shown only once. Copy and store it in a safe place before leaving the page.” — WooCommerce documentation
If the secret is lost, the practical recovery is to revoke the unusable key and generate a replacement; there is no dashboard step that reveals the old secret again. Do not ask a vendor to reconstruct it, because WooCommerce does not provide the original value after the creation screen is closed.
Choose the correct permission scope
Scope should reflect the operations the integration actually performs. Selecting Read/Write for convenience gives a compromised integration more power than a read-only reporting tool needs.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
| Integration activity | Recommended key scope | Why |
|---|---|---|
| View orders, products, customers, or reports | Read | Allows retrieval without permitting changes. |
| Create or update records but not retrieve them independently | Write | Allows modification operations; the application may still need additional read access for normal workflows. |
| Synchronize data in both directions | Read/Write | Required when the service both reads store records and creates or updates them. |
The key’s scope does not override the selected user’s WordPress capabilities. If the user cannot perform an operation in WordPress, assigning Write or Read/Write will not grant that missing capability. Conversely, a powerful user does not make a Read-only key able to modify records.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Ask the integration vendor which endpoints it calls before selecting a scope. A workflow that creates a shipment may also need to read orders first; in that case, Write alone can produce an authorization failure even though the application is described as a fulfillment connector.
Where to enter the Consumer Key and Secret
Most integrations provide separate fields for the store URL, Consumer Key, and Consumer Secret. Put the complete store origin in the URL field when requested, and paste each credential into its matching field without quotation marks or extra spaces. Some tools call the fields API key and API secret; confirm which field is sent as the username and which is sent as the password.
Use the same host that serves WordPress. A staging subdomain, a domain that redirects to another host, and a URL with an incorrect path can all cause a valid credential to appear broken. The API route normally starts with /wp-json/, followed by the WooCommerce namespace and version, such as /wc/v3/.
Store the secret in the integration’s encrypted credential store or a dedicated secrets manager, not in a public repository, a screenshot, a support ticket, or a client-side script. Limit access to people and services that operate the integration. Mask the secret in logs and redact it from bug reports.
Authenticate a REST request with HTTPS Basic Auth
For an HTTPS request, WooCommerce supports HTTP Basic Authentication. Send the Consumer Key as the username and the Consumer Secret as the password. A representative orders endpoint is /wp-json/wc/v3/orders; replace the host with your store and use the API version supported by that installation.
curl https://www.example.com/wp-json/wc/v3/orders
-u consumer_key:consumer_secretThe example uses placeholder values. In a real command, substitute your store host and the two generated credentials. Do not paste a live secret into shell history that other users can read; use your system’s protected environment or secret-injection mechanism where possible.
A successful request returns the endpoint’s normal JSON response. A response that reports authentication or authorization failure means the server received no usable credentials, the selected user lacks the required capability, or the key’s scope does not permit the operation. Basic Auth is appropriate only when the connection is protected by HTTPS; the encoding of the header is not encryption.
When Basic Auth cannot be used
Query-string fallback
Some hosting configurations remove or fail to forward the HTTP Authorization header. WooCommerce documents a fallback that sends consumer_key and consumer_secret as query-string parameters. Use this only over HTTPS, because credentials in a URL can be exposed through web-server logs, browser history, monitoring systems, or copied links.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Prefer fixing the proxy or server configuration so the Authorization header reaches WordPress. Treat the query-string form as a compatibility workaround, and check access logs afterward to ensure the secret is not being retained longer than necessary.
OAuth-style signed requests
WooCommerce also documents OAuth-style signing for clients that cannot use Basic Auth. The signature is calculated from the HTTP method, encoded URL, and encoded request parameters. The documented HMAC choices are HMAC-SHA1 and HMAC-SHA256. Follow the client or WooCommerce implementation’s parameter-ordering and encoding rules exactly; a correctly generated key will still fail if the signature base string differs from what the server calculates.
Signing changes how the request is assembled, not what the key can access. The selected WordPress user’s capabilities and the key’s Read/Write scope still apply. Confirm that the client library supports the WooCommerce signing format before attempting to troubleshoot permissions.
Test the credentials without risking store data
- Start with a read-only endpoint, such as a GET request for orders, products, or another resource the selected user can view.
- Use HTTPS and the exact store host. Confirm that the path begins with
/wp-json/and uses the intended WooCommerce API version. - Check the HTTP status and response body. A normal authenticated response confirms that the server recognized the credentials and permitted that resource.
- Only after a read test succeeds, test a write operation in a controlled environment or with a record you can safely remove. Do not begin by updating live orders or products.
- Record the key description, owning WordPress user, scope, and connected service in your operational documentation without recording the secret itself.
Postman and Insomnia can be used as REST clients for this validation. For local stores using a self-signed certificate, their SSL-verification settings may need adjustment during development. Re-enable verification before testing production credentials. A client-side certificate exception can hide a transport problem that production users will still encounter.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Troubleshoot common errors
401 Unauthorized
- Confirm that the Consumer Key is being sent as the Basic Auth username and the Consumer Secret as the password.
- Check that the request uses the same store URL and API route as the integration’s configuration.
- Verify that the selected WordPress user can access the requested resource and that the key’s scope allows the operation.
- Remove accidental spaces, line breaks, or quotation marks introduced while copying the values.
- If the values may have been exposed or corrupted, revoke the key, generate a new one, and update the integration.
Test the key against one known endpoint before changing several settings at once. This separates a credential problem from an endpoint, firewall, or application-code problem. If a newly generated key fails in the same way as an older one, inspect the server or proxy handling of the Authorization header.
“Consumer key is missing”
This message commonly indicates that the server did not receive the Authorization header. Check the web server, reverse proxy, security plugin, or hosting configuration that sits between the client and WordPress. If the header cannot be passed, use WooCommerce’s HTTPS query-string fallback while understanding its logging risk.
SSL or certificate errors on localhost
A local HTTPS certificate that is self-signed or issued by an unknown authority can cause Postman, Insomnia, or another client to reject the connection before WooCommerce evaluates the key. Configure the client to trust the local certificate, or temporarily adjust verification only for local testing. Never disable certificate verification for a production store.
Permission denied or incomplete results
Authentication proves which key was presented; authorization decides what that key may do. Select a WordPress user with the capability required by the endpoint and make sure the key’s Read, Write, or Read/Write setting matches the operation. A Write-only key is not a substitute for Read access when an application must first retrieve a record.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe REST API section or endpoint is unavailable
Recheck that WooCommerce is active, that the account can manage its settings, and that permalinks are not set to Plain. A non-Plain permalink structure is a prerequisite for reliable REST API route testing. Also verify that the requested API version is enabled by the installed WooCommerce release and that no security layer is blocking requests to /wp-json/.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Revoke, rotate, and audit keys
The generated-key screen includes a revoke action. Revoke a credential when an integration is retired, ownership changes, a secret may have leaked, or the connected service no longer needs access. Generate a replacement, update the service, verify a read test, and then retire the old key when performing a planned rotation.
Each key is tied to its selected WordPress user. Deleting that user stops the key from functioning, so user offboarding is also an API-access change. Include API keys in the same access review as administrator accounts and other service credentials.
Use descriptions that identify environment and owner, keep an inventory of active integrations, and grant the narrowest scope that supports the documented workflow. These practices make it possible to identify an unknown key quickly without exposing its secret.
A safe rotation sequence
- Create a replacement key with a recognizable description and the same or narrower required scope.
- Copy the new Consumer Key and Secret into the integration’s protected settings.
- Run a harmless read request and, if appropriate, a controlled write test.
- Confirm that scheduled jobs and webhooks are succeeding with the replacement.
- Revoke the old key and update your credential inventory.
Keeping the old key active only for the short overlap needed to deploy the replacement reduces downtime. If exposure is suspected, skip the overlap and revoke immediately, then investigate logs and the connected service.
Manual dashboard keys versus application authentication
| Approach | How credentials are created | Permission and authentication considerations | Best fit |
|---|---|---|---|
| Manual dashboard generation | An administrator creates a key under WooCommerce > Settings > Advanced > REST API. | The key is assigned to a WordPress user and receives Read, Write, or Read/Write scope. The integration then uses Basic Auth over HTTPS or signed requests. | A known, server-to-server integration that an administrator can configure directly. |
| Application authentication endpoint | The application redirects a user to an approval flow and receives generated API keys through its callback. | The user approves access during the flow; the resulting credentials still need secure storage and appropriate permissions. | Integrations that need an in-app approval experience instead of asking the user to copy credentials manually. |
The application authentication flow is intended to facilitate application integration. It is not a replacement for a customer login system. In a typical flow, the app starts an authorization request, the store owner reviews and approves it, and WooCommerce sends the generated credentials to the registered callback. Protect that callback and store the returned secret exactly as you would one generated in the dashboard.
Use manual generation when one administrator is configuring a known service and wants a straightforward audit trail. Use the application endpoint when many store owners need to connect their stores through the same product and an approval screen is more practical than asking each owner to copy credentials.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Questions to answer before handing over a key
- Which exact endpoints will the service call, and does it need to read, write, or both?
- Which WordPress user should represent the integration, and who owns that account?
- Will the client use HTTPS Basic Auth, a signed request, or the documented application approval flow?
- Where will the Consumer Secret be stored, and who can retrieve or rotate it?
- What is the rollback plan if a replacement key fails?
Writing these answers down prevents a common failure mode: creating a broad key first and discovering later that nobody knows what it is for or how to revoke it.
Pre-launch checklist
- The site uses a non-Plain permalink structure.
- The key description identifies the service and environment.
- The selected WordPress user has only the capabilities the integration requires.
- The key scope is Read, Write, or Read/Write based on actual operations.
- The Consumer Key and Consumer Secret are stored in protected credential fields.
- Requests use HTTPS, with certificate verification enabled in production.
- A harmless read request succeeds before any write operation is attempted.
- The team knows where to revoke the key and how to replace it if the integration changes.
- The API version and base URL are recorded alongside the integration configuration.
- Logs, screenshots, and support notes do not contain the Consumer Secret.
Frequently Asked Questions
Where do I find the WooCommerce Consumer Key and Consumer Secret?
After selecting Generate API Key at WooCommerce > Settings > Advanced > REST API, WooCommerce displays both values on the confirmation screen. Copy them immediately; the Consumer Secret is shown only once and cannot be revealed later.
Why is my WooCommerce API key returning 401 Unauthorized?
Check that the Consumer Key is sent as the Basic Auth username and the Consumer Secret as the password, that the request uses HTTPS and the correct store URL, and that the selected WordPress user and key scope permit the endpoint. If the Authorization header is being stripped, fix the server or proxy or use the documented HTTPS query-string fallback.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
What permissions should I choose for a WooCommerce REST API key?
Choose Read for retrieval-only tools, Write for operations that create or update records, and Read/Write when the integration must both retrieve and modify data. The selected WordPress user’s capabilities still limit the key, so a broader scope cannot grant permissions that user does not have.
Can I see an old Consumer Secret again?
No. WooCommerce does not show the secret again after you leave the generation screen. Revoke the key and create a replacement, then update the connected application.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What happens if I delete the WordPress user linked to a key?
The API reference states that deleting the associated user makes the key stop functioning. Create a replacement under an active, appropriately permitted user before offboarding the old account if the integration must continue.
Should I use Read/Write for convenience?
Only when the application genuinely needs both retrieval and modification. A read-only reporting service should use Read, because unnecessary write access increases the impact of a leaked credential.
Can I use WooCommerce keys without HTTPS?
Do not use Basic Authentication over unencrypted HTTP for a live store. Basic Auth sends credentials in an encoded header, not an encrypted one. Use HTTPS and keep certificate verification enabled in production.
What can I do when my server drops the Authorization header?
Inspect the web server, reverse proxy, and security-plugin configuration first. WooCommerce documents sending consumer_key and consumer_secret in the query string as a fallback, but use it only over HTTPS and account for credentials appearing in logs or monitoring data.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsIs the application authentication endpoint a customer login system?
No. WooCommerce describes it as an approval flow for application integration. It lets an app redirect a store owner for approval and receive generated API keys through a callback; it is not intended to authenticate shoppers.
The Bottom Line
Generate the key at WooCommerce > Settings > Advanced > REST API, assign it to the least-privileged suitable WordPress user, select the narrowest Read/Write scope, and copy the Consumer Secret before leaving the page. Test a harmless HTTPS request, store the credentials securely, and revoke or rotate the key whenever the connected service or owner changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
