For a new WooCommerce integration, use the version 3 REST API under /wp-json/wc/v3/. Confirm that the site runs WordPress 4.4 or newer and WooCommerce 3.5 or newer, enable a human-readable permalink structure, create a scoped REST API key, and call the endpoint over HTTPS with HTTP Basic Authentication. Keep the key and secret on your server, not in browser JavaScript.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
This guide walks through setup, authentication, practical requests, the difference between the authenticated REST API and the public Store API, and the fixes for common 401 and method errors.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What the WooCommerce REST API does
The authenticated WooCommerce REST API lets an application manage privileged store data. Depending on the resource and the permission attached to the key, an integration can read, create, update, and delete products, variations, orders, order notes, coupons, customers, shipping zones, and related records. The current recommended API version for new integrations is v3, whose base path is:
https://example.com/wp-json/wc/v3/Replace example.com with the WordPress site’s HTTPS hostname. The path is relative to the WordPress installation, so a site installed in a subdirectory may expose the REST API beneath that installation’s URL rather than the domain root.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Use this API when a trusted back-office service, mobile app backend, warehouse system, reporting job, or other server-side process needs authenticated store data. Do not expose a consumer secret in a public web page or ship it in a browser application.
Choose the right WooCommerce API surface
WooCommerce has two different REST-style surfaces. Choosing the wrong one is a frequent source of accidental data exposure or failed authentication.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Surface | Authentication | Typical use | Data boundary |
|---|---|---|---|
| WooCommerce REST API v3 | Required for protected resources | Manage products, orders, customers, coupons, shipping zones, and other store records | Privileged store data; access is controlled by the key’s WordPress user and scope |
| WooCommerce Store API | Unauthenticated for its public customer-facing routes | Product display, cart, checkout, and other storefront interactions | Designed not to expose sensitive store data or customer information |
A public storefront request should normally use the Store API. A fulfillment or administration service that must read orders should use the authenticated wc/v3 API. Authentication is not something to add to a Store API request simply because it feels safer; the two surfaces have different purposes and response models.
Prerequisites and server checks
Before generating credentials, verify all of the documented prerequisites:
- WordPress 4.4 or newer.
- WooCommerce 3.5 or newer.
- A human-readable permalink structure. The default Plain permalink option does not satisfy the documented requirement.
- HTTPS for normal operation. HTTP can be signed with OAuth 1.0a, but HTTPS is the safer and simpler deployment choice.
- A WordPress user whose capabilities are appropriate for the resources the integration must access.
Set a compatible permalink structure
- Sign in to WordPress administration.
- Open Settings > Permalinks.
- Select any non-Plain structure, such as Post name, and save the change.
Saving the settings refreshes WordPress rewrite rules. If the API later returns an HTML 404 page instead of JSON, revisit this setting and check that the web server is forwarding requests to WordPress.
Prefer HTTPS from the beginning
HTTPS encrypts both the request and the credentials used to authenticate it. It also avoids the need to implement OAuth signing for ordinary requests. A local development site using a self-signed certificate may require the client to trust that certificate or to disable verification temporarily; never carry an insecure verification workaround into production.
Create WooCommerce REST API keys
Keys are generated in WooCommerce administration and are attached to a WordPress user. The user’s capabilities and the key’s read/write scope jointly determine what the integration can do.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
- Open WooCommerce > Settings > Advanced > REST API.
- Select Add key (or the equivalent button for creating a new key).
- Enter a descriptive name, such as Warehouse sync production. Use a name that identifies the application and environment.
- Choose the WordPress user whose capabilities should apply to requests made with this key.
- Select a permission level: Read, Write, or Read/Write.
- Generate the key.
- Copy both the consumer key and consumer secret into a secure server-side secret store before leaving the page.
The consumer secret is displayed only once. If it is lost, create a replacement key rather than expecting WooCommerce to reveal the old secret. Treat the secret like a password: restrict access, do not put it in source control, and rotate or revoke it when an application is decommissioned.
| Permission | Use it when | What it prevents |
|---|---|---|
| Read | The integration only fetches products, orders, or reports | Creation, modification, and deletion through that key |
| Write | The integration submits changes and does not need to read protected records | Read operations through that key |
| Read/Write | The workflow must retrieve a record and then create or update related data | Nothing beyond the capabilities of the selected WordPress user; use only when both directions are necessary |
Use the narrowest permission that completes the job. A read-only reporting process should not receive write access simply because it is convenient.
Build the v3 endpoint URL
Start every authenticated request with the v3 base path:
https://example.com/wp-json/wc/v3/Append the resource route. Common examples include:
productsfor products.products/{id}for one product.products/{id}/variationsfor variations belonging to a product.ordersandorders/{id}for orders.orders/{id}/notesfor order notes.couponsfor coupons.customersfor customers.shipping/zonesfor shipping zones.
Whether a route supports create, read, update, or delete depends on that resource. Consult the v3 route documentation for the exact fields and permitted methods rather than assuming every route supports every operation.
Authenticate over HTTPS with Basic Auth
For an HTTPS request, provide the consumer key as the username and the consumer secret as the password. The server sends an HTTP Authorization header containing those credentials.
curl https://example.com/wp-json/wc/v3/orders
-u consumer_key:consumer_secretIn a shell, replace both values with the credentials generated in WooCommerce. Do not paste real secrets into a shared terminal transcript or commit this command to a script that will be distributed.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Use an explicit header when your client requires it
Most HTTP libraries have a Basic Auth option. If you must construct the header yourself, encode the literal string consumer_key:consumer_secret with Base64 and send:
Authorization: Basic BASE64_OF_KEY_COLON_SECRETBase64 is an encoding, not encryption. It is acceptable only because the entire request is protected by HTTPS and the secret remains private.
HTTP and one-legged OAuth 1.0a
When HTTPS is unavailable, WooCommerce’s documented alternative is one-legged OAuth 1.0a signing. The request includes a nonce, timestamp, signature method, and calculated signature so credentials are not sent as an interceptable plain Basic Auth exchange. Implementing OAuth correctly requires a library that handles parameter normalization and signing; do not improvise the signature calculation. In production, enable HTTPS and use Basic Auth instead.
Run a first smoke test
Test the credentials with a harmless read request before writing data. An order collection request is the official-style example:
Free tools Windows power users keep installed
One-click scans. No signup required.
curl https://example.com/wp-json/wc/v3/orders
-u consumer_key:consumer_secretA successful response is JSON, normally an array of order objects (possibly empty) with an HTTP success status. An error response should also be JSON when WordPress is receiving the request correctly. Capture the HTTP status and response body while diagnosing failures:
curl --include --silent --show-error
https://example.com/wp-json/wc/v3/orders
-u consumer_key:consumer_secretDo not use a write request as your first test. Once authentication works, make a deliberately small create or update request in a staging environment and verify the result in WooCommerce administration.
Practical request examples
List products with query parameters
Resource routes accept documented query parameters for filtering, pagination, ordering, and field selection. For example, this requests products from page two, with 20 items per page:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
curl 'https://example.com/wp-json/wc/v3/products?per_page=20&page=2'
-u consumer_key:consumer_secretURL-encode parameter values in application code. Pagination metadata is returned in response headers by WordPress; use those headers rather than assuming a fixed number of pages.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsCreate a product
Creating data requires a key with write capability and a JSON request body. The exact required fields depend on the product type and WooCommerce version. A minimal simple-product example is:
curl -X POST 'https://example.com/wp-json/wc/v3/products'
-u consumer_key:consumer_secret
-H 'Content-Type: application/json'
-d '{
"name": "Example game",
"type": "simple",
"regular_price": "29.99"
}'Use a staging site first. Store prices as strings in the JSON representation shown by WooCommerce, and validate currency, tax, stock, images, categories, and SKU rules in your own integration before submitting.
Update an order
Use the order’s numeric ID and send only the fields that should change. For example, an integration may update the status after fulfillment:
curl -X PUT 'https://example.com/wp-json/wc/v3/orders/123'
-u consumer_key:consumer_secret
-H 'Content-Type: application/json'
-d '{
"status": "completed"
}'Replace 123 with an actual order ID. Check the response and record the returned status rather than assuming the update succeeded because the connection completed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Delete a resource
Deletion is irreversible for many resources. Where a route supports it, send DELETE and require an explicit confirmation in your application:
curl -X DELETE 'https://example.com/wp-json/wc/v3/products/123?force=true'
-u consumer_key:consumer_secretThe force parameter and deletion behavior are route-specific. Verify the resource documentation and test with disposable data; do not generalize this example to orders or customer records.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
JavaScript from a server-side process
Use a server-side runtime, environment variables, and a normal HTTPS client. The following Node-style example keeps credentials out of source code and sends Basic Auth:
const key = process.env.WC_CONSUMER_KEY;
const secret = process.env.WC_CONSUMER_SECRET;
const auth = Buffer.from(`${key}:${secret}`).toString('base64');
const response = await fetch('https://example.com/wp-json/wc/v3/products', {
headers: { Authorization: `Basic ${auth}` }
});
if (!response.ok) {
throw new Error(`WooCommerce returned ${response.status}`);
}
const products = await response.json();Do not move this code into a browser bundle. Anyone who can inspect that bundle could recover the credentials and use them against the store.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallPython with requests
import os
import requests
response = requests.get(
'https://example.com/wp-json/wc/v3/orders',
auth=(os.environ['WC_CONSUMER_KEY'], os.environ['WC_CONSUMER_SECRET']),
timeout=30,
)
response.raise_for_status()
orders = response.json()Set a timeout, handle non-2xx responses, and add retry logic only for failures that are safe to retry. A timed-out POST may have reached the server, so blindly repeating it can create duplicates.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep credentials and data safe
- Store keys in environment variables or a managed secret store, not in Git, front-end bundles, issue trackers, or logs.
- Use a dedicated WordPress user for each integration where practical, with only the capabilities it needs.
- Choose Read for reporting jobs and reserve Read/Write for workflows that genuinely modify records.
- Use HTTPS and validate the certificate in production.
- Redact the consumer secret and customer data from application logs.
- Rotate a key if it may have been exposed, and revoke unused keys.
- Restrict administrative endpoints at the network or application layer when the deployment permits it, without blocking legitimate API traffic.
Why a request returns 401 Unauthorized
A 401 generally means WooCommerce could not authenticate the request or the authenticated user cannot access the requested resource. Check the causes in this order:
- Verify the pair exactly. Make sure the consumer key and consumer secret belong to the same generated key. A copied trailing space or a secret from an older key is enough to fail.
- Check the key’s scope. A Read key cannot create or update data. A Write key cannot perform a read that requires read permission. The selected WordPress user must also have capabilities for the resource.
- Confirm the URL. New integrations should use
/wp-json/wc/v3/, not a mistyped route or an obsolete API path. - Inspect the Authorization header. Reverse proxies, FastCGI configurations, and some server setups can strip the header before PHP receives it.
- Test the same credentials outside your application. A minimal cURL request helps separate a client-library bug from a server or key problem.
When the server drops the Authorization header
The official documentation describes query-string credentials as a constrained fallback when a server cannot pass the Authorization header. Over HTTPS, a request may be written with the key and secret as query parameters, using the parameter names expected by WooCommerce. Because URLs can be recorded in proxy logs, browser history, analytics, and monitoring systems, use this only when necessary, only over HTTPS, and scrub those URLs from logs. Fix the proxy or FastCGI configuration instead of making query-string authentication your permanent design.
Other common failures
HTML 404 or a WordPress page instead of JSON
- Confirm that the URL includes
/wp-json/wc/v3/and the correct site path. - Ensure a non-Plain permalink structure is enabled and saved.
- Check web-server rewrite rules and that WordPress is receiving the request.
- Verify that the WooCommerce plugin is active and current enough for the v3 route you are calling.
SSL or certificate errors on localhost
Development sites commonly use self-signed certificates. Configure your development client to trust the local certificate, or temporarily disable verification only in an isolated local environment. Never disable certificate verification in production, where it would make credential interception possible.
POST, PUT, or DELETE is rejected
Some hosting or proxy configurations allow GET but reject other HTTP methods. Check the web server, firewall, proxy, and security-plugin rules for method filtering. WooCommerce documentation mentions an _method fallback where appropriate; use it only when the route and server support that convention, and prefer fixing method handling at the server.
Response is an unexpected login page or redirect
A redirect to a WordPress login page usually indicates that another authentication layer, maintenance mode, or security plugin is intercepting the request. Follow redirects during diagnosis, inspect the first response status, and allow the REST route through the intervening layer without weakening WooCommerce key authentication.
Version choices and legacy integrations
Use v3 for new work. The legacy REST API was removed from WooCommerce core. An existing integration that still depends on legacy behavior requires the separate WooCommerce Legacy REST API plugin, and it should be treated as migration debt rather than the default for a new project.
| Decision | Recommended choice | Reason |
|---|---|---|
| New authenticated integration | REST API v3 at /wp-json/wc/v3/ |
It is the current recommended version and covers core store resources. |
| Public cart or checkout UI | Store API routes | They are designed for customer-facing, unauthenticated storefront behavior. |
| Transport | HTTPS with Basic Auth | It is simpler to operate and protects credentials in transit. |
| Read-only reporting | Read key attached to a limited user | It reduces the impact of a leaked credential. |
| Existing legacy dependency | Install the Legacy REST API plugin only if required, then plan a v3 migration | Legacy routes are not part of WooCommerce core. |
A production-readiness checklist
- WordPress is 4.4 or newer and WooCommerce is 3.5 or newer.
- Permalinks use a human-readable structure rather than Plain.
- The site has a valid HTTPS certificate.
- The integration uses the
wc/v3base path. - A dedicated WordPress user and least-privilege key scope are in place.
- The consumer secret is stored server-side and absent from source control and browser code.
- A read-only smoke test succeeds before any write operation is enabled.
- Requests set timeouts, handle non-2xx responses, and avoid unsafe retries.
- Logs redact credentials and unnecessary customer information.
- Staging tests cover product, order, and error paths before production rollout.
- There is a process to revoke and replace keys when staff, vendors, or applications change.
Putting the pieces together
The reliable setup is deliberately small: enable compatible permalinks, create a scoped key under WooCommerce’s REST API settings, copy the one-time secret, and call /wp-json/wc/v3/ over HTTPS with Basic Auth. Use the authenticated API only for trusted operations that need store data; use the unauthenticated Store API for public cart, checkout, and product experiences. When a request fails, check the key pair, permissions, route, and authorization-header handling before changing application code.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
