How to Use the WooCommerce REST API: Complete Setup and Examples

Use WooCommerce REST API v3 for server-side integrations that need store data or administrative actions. The base URL is https://example.com/wp-json/wc/v3/. Create a key pair in WooCommerce > Settings > Advanced > REST API, give it the least privilege required, and authenticate over HTTPS with HTTP Basic Authentication: the consumer key is the username and the consumer secret is the password.

Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.

This guide walks through prerequisites, key creation, authentication, first requests, endpoint choices, code examples, security, and the fixes for common 401 and server-configuration errors. It also explains when the separate unauthenticated Store API is the right choice for a customer-facing frontend.

#	Preview	Product	Price
1		The Woocommerce playbook: The step-by-step guide to mastering Woocommerce and selling online	$7.99	Buy on Amazon
2		WordPress WooCommerce	$24.99	Buy on Amazon
3		Building E-Commerce Solutions with WooCommerce - Second Edition	$40.99	Buy on Amazon
4		Latin Real Book: C Edition	$38.99	Buy on Amazon
5		Mastering WooCommerce 4: Build complete e-commerce websites with WordPress and WooCommerce from...	$38.65	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

What the WooCommerce REST API is

The WooCommerce REST API is an authenticated HTTP interface for managing and reading store data from an external application. The current and recommended version for new integrations is v3, whose endpoints begin with /wp-json/wc/v3/. Depending on the resource and method, the API supports creating, reading, updating, and deleting records.

Typical resources include products, product variations, orders, order actions, order notes, coupons, customers, and shipping zones. A warehouse service, accounting connector, mobile back office, or internal automation can use these endpoints without logging into the WordPress dashboard.

#1 Best Overall

The Woocommerce playbook: The step-by-step guide to mastering Woocommerce and selling online

$7.99

Buy on Amazon

There are two WooCommerce API surfaces, and choosing the wrong one is a common design mistake:

If an application needs order records or customer details, use the authenticated REST API from a trusted server. If a browser checkout only needs public product, cart, or checkout operations, evaluate the Store API instead of exposing an administrative key.

Prerequisites and compatibility

Before generating credentials, verify the documented minimum versions and URL configuration:

After changing the permalink setting, save it even if the desired structure was already selected. This refreshes WordPress rewrite rules, which can resolve unexplained 404 responses on /wp-json/ paths.

Rank #2

WordPress WooCommerce

$24.99

Buy on Amazon

Create WooCommerce REST API keys

Keys are attached to a WordPress user. The API request therefore inherits what that user is allowed to do; selecting an administrator is not automatically necessary and is often broader access than an integration needs.

1. Sign in to the WordPress dashboard with permission to manage WooCommerce settings.
2. Open WooCommerce > Settings > Advanced > REST API.
3. Select Add key (the exact button text can vary slightly by WooCommerce release).
4. Enter a descriptive name such as Warehouse sync - production. Use a name that identifies the system and environment.
5. Choose the WordPress user whose capabilities should apply to requests made with this key.
6. Set the permission level: Read, Write, or Read/Write.
7. Generate the key.
8. Copy both the consumer key and consumer secret into a secure server-side secret store before leaving the page. WooCommerce displays the consumer secret only once; it cannot be retrieved later from the dashboard.

Use separate keys for development, staging, and production. If one environment is compromised, revoking that key does not require changing every integration. Give a read-only reporting process a read-only key, and reserve write access for software that actually creates or changes records.

Choose the permission scope

The key’s scope and the selected user’s WordPress capabilities both matter. A read/write key does not grant abilities that the underlying user does not have, and changing a user’s capabilities can change what an existing key can do.

Use the v3 endpoint correctly

Build every new request from this base path:

https://example.com/wp-json/wc/v3/

Append the resource name, for example:

• orders for order records
• products for products
• products/<id> for one product
• customers for customers
• coupons for coupons
• shipping/zones for shipping zones

Replace example.com with the store’s actual hostname and keep the wc/v3 segment. Older v1 or v2 paths are not the current recommendation for new work.

Rank #3

Building E-Commerce Solutions with WooCommerce - Second Edition

$40.99

Buy on Amazon

Authenticate over HTTPS with Basic Auth

For an HTTPS request, send the consumer key as the Basic Auth username and the consumer secret as the password. The client encodes the pair in the Authorization header.

curl https://example.com/wp-json/wc/v3/orders 
  -u consumer_key:consumer_secret

A successful response is an HTTP 200 response containing JSON for the orders the selected user may read. An empty store can legitimately return an empty JSON array, so an empty result is not by itself an authentication failure.

Do not put the key pair in browser JavaScript, a mobile app, a public repository, screenshots, issue reports, or a URL copied into a support ticket. Keep credentials in server-side environment variables or a secret manager and redact them from application logs.

Python example

import os
import requests

base = 'https://example.com/wp-json/wc/v3'
response = requests.get(
    f'{base}/orders',
    auth=(os.environ['WC_CONSUMER_KEY'], os.environ['WC_CONSUMER_SECRET']),
    timeout=30,
)
response.raise_for_status()
orders = response.json()
print(orders)

This example keeps credentials outside the source file and lets the HTTP client create the Basic Auth header.

Rank #4

Sale

Latin Real Book: C Edition

• Features Over 160 Latin Songs
• Arranged for C Instruments
• Standard Notation
• 48 Pages

$38.99

Buy on Amazon

PHP example with cURL

<?php
$ch = curl_init('https://example.com/wp-json/wc/v3/orders');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_USERPWD => getenv('WC_CONSUMER_KEY') . ':' . getenv('WC_CONSUMER_SECRET'),
    CURLOPT_HTTPAUTH => CURLAUTH_BASIC,
    CURLOPT_TIMEOUT => 30,
]);
$body = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($status < 200 || $status >= 300) {
    throw new RuntimeException('WooCommerce API request failed: HTTP ' . $status);
}
echo $body;

What changes when the site is HTTP-only

For an unencrypted HTTP connection, the documentation requires one-legged OAuth 1.0a signing rather than sending Basic Auth credentials in clear form. OAuth requires a timestamp, nonce, signature method, and calculated signature for each request. Implementing it correctly is more involved than adding -u to a cURL command.

Use HTTPS as the normal production solution. If a legacy HTTP deployment cannot be upgraded immediately, use a maintained OAuth 1.0a implementation, protect the network path, and plan the HTTPS migration. Never treat HTTP Basic Auth as safe merely because the request uses a POST method; the transport remains unencrypted.

Run a first smoke test

Test authentication before writing synchronization logic. A single GET request isolates URL, credentials, permissions, TLS, and server-header problems.

1. Set the base URL to the store’s HTTPS hostname and verify that /wp-json/wc/v3/ is present.
2. Run the orders request from the server that will host the integration:

   curl -i https://example.com/wp-json/wc/v3/orders 
     -u "$WC_CONSUMER_KEY:$WC_CONSUMER_SECRET"

3. Inspect the HTTP status and response body. A 2xx response confirms that the request reached WooCommerce and was authenticated.
4. Only after the smoke test succeeds, add the resource-specific create, update, or delete operations your application needs.

Using environment variables in the shell command prevents the secret from being hard-coded in a script. Shell history and process inspection can still expose secrets on some systems, so use your deployment platform’s secret-injection mechanism for long-running services.

Best Value

Sale

Mastering WooCommerce 4: Build complete e-commerce websites with WordPress and WooCommerce from scratch

$38.65

Buy on Amazon

Common REST API operations and endpoint choices

The table shows path patterns, not a guarantee that every method is enabled for every resource. Check the endpoint’s v3 documentation for the fields and operations supported by the exact resource before sending production writes.

Read products from a server

curl https://example.com/wp-json/wc/v3/products 
  -u "$WC_CONSUMER_KEY:$WC_CONSUMER_SECRET"

Create a product from a controlled backend

curl -X POST https://example.com/wp-json/wc/v3/products 
  -u "$WC_CONSUMER_KEY:$WC_CONSUMER_SECRET" 
  -H 'Content-Type: application/json' 
  -d '{"name":"Example product","type":"simple"}'

Use a write or read/write key only for a process that is authorized to create catalog data. Validate the returned status and JSON, store the returned resource ID, and record enough request context to reconcile a retry without creating unintended duplicates.

Update a known order

curl -X PUT https://example.com/wp-json/wc/v3/orders/123 
  -u "$WC_CONSUMER_KEY:$WC_CONSUMER_SECRET" 
  -H 'Content-Type: application/json' 
  -d '{"customer_note":"Processed by the fulfillment service"}'

Replace 123 with the actual order ID and send only fields your workflow is permitted to change. Treat order updates as business actions: log who or what initiated them and test against a staging store before enabling them in production.

REST API v3 versus the Store API

The authenticated REST API is the correct boundary for privileged operations. A backend can use it to synchronize products, retrieve orders, manage coupons, or inspect customer and shipping-zone records according to the key’s permissions.

The Store API is a separate, unauthenticated surface for customer-facing product, cart, and checkout functionality. It intentionally does not provide sensitive store or customer information. A public web page can call that surface for a shopping experience, while a trusted server handles administrative synchronization through REST API v3.

• Use REST API v3 when the caller must identify itself and access protected store records.
• Use the Store API when the caller is a customer-facing interface that needs public commerce interactions.
• Never put a REST API consumer secret in a public frontend merely to avoid building a backend proxy.

Security and deployment practices

• Prefer HTTPS everywhere. Redirect HTTP to HTTPS and ensure the certificate is valid in production.
• Use least privilege. Match the key’s read, write, or read/write setting to the integration’s actual job and select a narrowly capable WordPress user.
• Separate environments. Use different keys for local development, staging, and production; revoke a key when the service or employee using it is retired.
• Protect logs. Remove Authorization headers, query strings, request bodies containing secrets, and full customer responses from routine logs.
• Validate responses. Check HTTP status codes and parse JSON errors rather than assuming that a TCP connection means the operation succeeded.
• Control write retries. Network timeouts can happen after WooCommerce has accepted a write. Reconcile the resource before retrying so a transient failure does not create duplicate records.
• Restrict exposure. Keep administrative API calls on a backend or private worker; the Store API is the public-facing option for supported customer flows.

Troubleshoot 401 Unauthorized and other failures

A disciplined 401 investigation

1. Run the request with the exact v3 base path and HTTPS hostname.
2. Generate a temporary test key and copy the secret immediately after generation; do not reuse a truncated or previously exposed value.
3. Use a GET request to /orders so write permissions are not part of the first test.
4. Confirm the key is assigned to the intended WordPress user and that the selected scope includes the operation.
5. Test from the production server, not only from a local laptop; proxies and web-server rules can differ.
6. Inspect server configuration for forwarding of the HTTP Authorization header.
7. Revoke the temporary key after diagnosis and create a properly named environment key.

When to use the legacy API plugin

WooCommerce removed the legacy REST API from core. New development should target v3. Only an existing integration that cannot yet migrate should consider the separate WooCommerce Legacy REST API plugin, and that dependency should be treated as a migration constraint rather than a reason to start a new project on v1 or v2.

Quick Recap

Bestseller No. 1

The Woocommerce playbook: The step-by-step guide to mastering Woocommerce and selling online

$7.99

Bestseller No. 2

WordPress WooCommerce

$24.99

Bestseller No. 3

Building E-Commerce Solutions with WooCommerce - Second Edition

$40.99

SaleBestseller No. 4

Latin Real Book: C Edition

Features Over 160 Latin Songs; Arranged for C Instruments; Standard Notation; 48 Pages

$38.99

SaleBestseller No. 5

Mastering WooCommerce 4: Build complete e-commerce websites with WordPress and WooCommerce from scratch

$38.65

Implementation checklist

• WordPress is 4.4 or newer and WooCommerce is 3.5 or newer.
• A human-readable permalink structure is active; plain/default permalinks are not used.
• HTTPS works from the machine that will run the integration.
• The key was created at WooCommerce > Settings > Advanced > REST API.
• The consumer secret was copied once and stored in a server-side secret manager.
• The key’s read/write scope matches the job, and its WordPress user has the required capabilities.
• The first request uses /wp-json/wc/v3/ and succeeds before write operations are enabled.
• No consumer secret appears in browser code, source control, URLs, or ordinary logs.
• Public customer-facing functionality uses the Store API where appropriate, not an exposed administrative key.
• Legacy v1/v2 requirements are documented and isolated if a migration is temporarily impossible.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.