Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteGenerate a WooCommerce REST API key in WordPress dashboard → WooCommerce → Settings → Advanced → REST API. Select Add Key (also shown as Create an API key), name the connection, assign a WordPress user, choose Read, Write, or Read/Write, and select Generate API Key. Copy the displayed Consumer Key and Consumer Secret immediately; WooCommerce displays the secret only once.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What a WooCommerce API key does
A WooCommerce REST API key authenticates an external application against your store. The key is actually a pair of credentials: a Consumer Key and a Consumer Secret. The application sends that pair with requests to WooCommerce REST endpoints, such as the orders endpoint, so it can retrieve or change store data without using a person’s WordPress password.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Each key is tied to one WordPress user. WooCommerce evaluates requests using that user’s roles and capabilities, in addition to the key’s own permission setting. Consequently, generating a key for an administrator and generating one for a restricted shop-management user can produce very different results even when both keys are set to Read/Write.
Keys are intended for integrations such as inventory synchronization, reporting, fulfillment, accounting, or a custom application. They are not customer login credentials. Give every service its own named key so that you can identify, rotate, or revoke that service without interrupting unrelated integrations.
#1 Best Overall
Check these prerequisites first
- Administrator access: You need permission to open WooCommerce settings and create REST API keys.
- A working WooCommerce store: The WordPress site and WooCommerce installation must be active before an integration can make useful requests.
- Non-Plain permalinks: In WordPress → Settings → Permalinks, choose a human-readable structure rather than Plain. Save the setting before testing REST routes.
- HTTPS: Use an HTTPS store URL for normal requests. It encrypts credentials while they travel between the client and the store.
- A defined integration: Know which system will connect and whether it only reads data or must create and update records. This determines the least permission the key needs.
Plan a descriptive key name before opening the form. Names such as Inventory sync, Reporting dashboard, or Warehouse connector identify the service later, which is especially useful when several keys exist.
Generate the Consumer Key and Consumer Secret
- Sign in to the WordPress administrator area.
- Open WooCommerce → Settings.
- Select the Advanced tab.
- Open the REST API section. Depending on the current WooCommerce interface, the creation control may be labeled Add Key or Create an API key.
- Enter a description that identifies the connected service.
- Choose the WordPress user whose roles and capabilities should govern requests made with this key.
- Choose the smallest permission level that supports the integration: Read, Write, or Read/Write.
- Select Generate API Key.
- Copy both values into the integration’s credential fields, along with the store URL if the integration requests it. Save them in the integration’s secret storage before navigating away.
The result page displays the Consumer Key and Consumer Secret. The secret is not recoverable from the dashboard after you leave the page. WooCommerce’s merchant documentation states: “The Consumer Secret is shown only once. Copy and store it in a safe place before leaving the page.” If the secret was not saved, revoke that key and create a replacement rather than trying to guess or reconstruct it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the right permission level
The permission selector controls the broad direction of API access. It does not override the selected WordPress user’s capabilities, and it cannot grant an integration access that the user does not have.
| Setting | What requests can do | Typical use | Risk and decision |
|---|---|---|---|
| Read | Retrieve permitted store data. | Reporting, dashboards, analytics exports, stock monitoring, or a read-only data warehouse. | Prefer this when the service never needs to create, edit, or delete records. |
| Write | Create or update permitted data without read access being implied by the key setting. | A narrowly designed publisher or synchronization process that sends changes to the store. | Use only when the application’s workflow genuinely writes data. Confirm that it does not also require GET requests for validation. |
| Read/Write | Retrieve and modify permitted data. | Two-way inventory synchronization, order-management systems, or applications that read a record before updating it. | Most powerful of the three choices; reserve it for integrations that need both directions. |
Choose the WordPress user separately from the permission level. For example, a Read/Write key assigned to a user lacking the capability to manage a particular resource will still fail for that resource. Conversely, assigning a powerful user to a key used by a simple reporting script gives the script more potential access than it needs. A dedicated, appropriately limited WordPress user is safer than automatically selecting an administrator.
Store the credentials safely
Treat the Consumer Secret like a password. Put it in the connected application’s encrypted secret store, environment variables managed by the deployment system, or another access-controlled credential vault. Do not commit it to a source-code repository, paste it into a public issue, include it in browser-side JavaScript, or place it in screenshots and documentation that other people can download.
Rank #2
Keep the Consumer Key with the secret when the integration requires both, but remember that the key identifies the credential while the secret proves possession. Limit access to the person or service that operates the integration. Record the key’s description, owner, creation date, associated WordPress user, and intended scope in an internal inventory without recording the secret in plain text.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Use the key with HTTPS Basic Authentication
For an HTTPS request, WooCommerce supports HTTP Basic Authentication. Send the Consumer Key as the username and the Consumer Secret as the password. The endpoint includes your store host and the REST API version. A representative orders request is:
curl https://www.example.com/wp-json/wc/v3/orders -u consumer_key:consumer_secretReplace the host and credential values with those belonging to your store and integration. The wc/v3 segment identifies the REST API version in this example; use the version and route required by the resource you are calling. The same credential placement applies in a REST client: set Basic Auth, enter the Consumer Key in the username field, and enter the Consumer Secret in the password field.
Only send Basic Authentication over HTTPS. Plain HTTP exposes the credential pair to interception. If a proxy, security plugin, or web server removes the HTTP Authorization header, the request may arrive without credentials even though the client is configured correctly.
When Basic Auth cannot reach the server
WooCommerce also documents OAuth-style signing for environments where the server does not pass the Authorization header correctly. The client calculates a signature from the HTTP method, encoded URL, and encoded request parameters. WooCommerce accepts HMAC-SHA1 and HMAC-SHA256 for this signing process.
Signed requests require exact encoding and timestamp or nonce handling according to the WooCommerce API rules. Use an established WooCommerce-compatible client or implement the documented signing algorithm carefully; changing parameter order, encoding characters differently, or signing a URL that does not exactly match the requested URL causes authentication failure. Do not switch to query-string credentials merely to avoid implementing signing unless the request is protected by HTTPS and the server configuration requires that fallback.
Test the generated credentials
- Confirm that the store resolves over HTTPS and that permalinks are not set to Plain.
- Start with a harmless GET request to a resource the selected WordPress user is allowed to read. The orders route shown above is a common example, but use a resource appropriate to your integration.
- Check the HTTP status and response body. A successful response should contain the requested WooCommerce data in JSON; an authentication or capability problem normally returns an error status and message.
- After a read test succeeds, test a write operation only in a controlled environment or with a record that can safely be corrected. Confirm that the key’s scope and the user’s capabilities produce the intended result.
- Remove test data and preserve the request details, endpoint, response status, and integration version in your operational notes.
Postman and Insomnia can both be used as REST clients for this test. Their request history also helps distinguish a credential problem from an incorrect route, payload, or content type.
Troubleshoot common errors
401 Unauthorized
A 401 response means WooCommerce did not accept the authentication or the request could not be authorized for the selected identity. Check the following in order:
- Confirm that the Consumer Key is in the username field and the Consumer Secret is in the password field; do not reverse them.
- Verify that the client is calling the correct store host and REST route.
- Check that the selected WordPress user still exists and retains the capability required by the resource.
- Make sure the request is HTTPS and that the web server or proxy forwards the Authorization header.
- Compare the credential values character by character, without added spaces or line breaks.
- If the values may have been exposed, revoke the key and generate a new one rather than continuing to test a compromised credential.
If a newly generated key works while the old one does not, update every deployment, worker, and scheduled job that still stores the old pair.
“Consumer key is missing”
This message commonly appears when the server strips the Authorization header. WooCommerce documents a query-string fallback using the parameters consumer_key and consumer_secret. Use that fallback only over HTTPS because the credentials become part of the URL and may be recorded by web-server logs, proxy logs, browser history, or monitoring systems. Correcting the server or proxy so it forwards Authorization is preferable for a long-lived integration.
Rank #4
- Features Over 160 Latin Songs
- Arranged for C Instruments
- Standard Notation
- 48 Pages
Permission or forbidden errors
A valid key can still be refused when its permission setting or associated user is insufficient. Check that Read is present for retrieval, Write is present for creation or updates, and that the selected WordPress user has the relevant WooCommerce capability. A key set to Write will not satisfy an integration that first performs a read, while Read cannot authorize a modification. Adjust the scope only after confirming what the application actually does.
SSL errors on localhost or self-signed certificates
Local development stores often use self-signed certificates. REST clients such as Postman and Insomnia expose SSL verification settings that can help diagnose this condition. Disabling certificate verification can be acceptable as a narrowly controlled local test, but it removes an important security check and should not be used in production. The production fix is a certificate that the client trusts and a correctly configured HTTPS hostname.
The REST API menu or route is unavailable
Confirm that WooCommerce is active, that you are signed in with an account allowed to manage its settings, and that you are using the current dashboard path under WooCommerce → Settings → Advanced. A Plain permalink structure can also prevent expected REST routes from working. Save a non-Plain permalink structure, then retest the endpoint.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRevoke, rotate, and retire keys
The generated-key screen includes a revoke action. Revoke a key when an integration is decommissioned, ownership changes, a secret may have leaked, or the service no longer needs access. Generate a replacement first when you need a no-downtime rotation: store the new pair in the integration, verify a successful request, and then revoke the old key.
A key remains associated with its selected WordPress user. The WooCommerce API reference states that deleting that user makes the key stop functioning. Before deleting a user, identify every key connected to it and migrate active integrations to a new, deliberately chosen user. Keep a record of which service owns each key so an emergency revocation does not become a guessing exercise.
Best Value
Review keys periodically. A practical inventory includes the description, associated user, Read/Write scope, owning team, creation date, last confirmed use, and planned retirement date. Remove unused credentials instead of allowing them to remain valid indefinitely.
Application-driven authentication
WooCommerce documents an application authentication endpoint for integrations that need a user-approval flow. In that model, an application sends the store administrator through an approval step and receives generated API keys at a callback. It is useful when a software vendor connects many independent stores and should not ask users to copy credentials manually.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
This flow is for authorizing an application integration, not for signing customers into the storefront. The application must protect the callback, validate the returned values, store the credentials securely, and provide a way for the store owner to disconnect or revoke access. If you control a single store and are configuring one internal service, manual dashboard generation is usually simpler.
Security checklist before going live
- Use a separate key for each integration rather than sharing one pair across services.
- Name each key after the actual system or job that uses it.
- Assign a WordPress user with only the capabilities required by that integration.
- Choose Read, Write, or Read/Write according to the operations the application performs, not according to convenience.
- Keep the Consumer Secret in encrypted server-side storage and out of client-side code and repositories.
- Use HTTPS for every request and avoid query-string credentials when header authentication can work.
- Test with a safe record before allowing a write-capable integration to process live orders or products.
- Document ownership, rotation procedures, and the location of the revoke control.
- Revoke and replace credentials after staff changes, vendor changes, suspected exposure, or integration retirement.
Key facts to remember
The complete dashboard path is WooCommerce → Settings → Advanced → REST API. A key belongs to a specific WordPress user and carries Read, Write, or Read/Write scope. WooCommerce shows the Consumer Secret only during generation, so save it before leaving the page. For HTTPS Basic Authentication, place the Consumer Key in the username position and the Consumer Secret in the password position. Revoking the key, or deleting its associated WordPress user, stops that credential from working.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
