REST API Authentication

The WooCommerce REST API requires authentication for all requests. This guide covers the available authentication methods and how to implement them.

Authentication Methods

WooCommerce supports multiple authentication methods:

REST API Keys (Recommended for most integrations)
OAuth 1.0a (For third-party applications)
Basic Authentication (HTTPS only, simple testing)
JWT (JSON Web Tokens, with plugins)

REST API Keys

The recommended authentication method for most integrations. API keys are generated through the WooCommerce admin interface.

Generating API Keys

Navigate to WooCommerce > Settings > Advanced
Click the REST API tab
Click Add key
Configure the key:
- Description: Name to identify the key (e.g., “Mobile App Integration”)
- User: WordPress user with appropriate permissions
- Permissions: Read, Write, or Read/Write
Click Generate API Key
Save your keys immediately - the Consumer Secret is shown only once

Store your Consumer Key and Consumer Secret securely. The Consumer Secret cannot be retrieved after closing the page.

Key Components

After generation, you’ll receive:

Consumer Key: Public identifier (e.g., ck_1234567890abcdef)
Consumer Secret: Private key (e.g., cs_1234567890abcdef)

Using API Keys with HTTPS

When your site uses HTTPS, use HTTP Basic Authentication:

curl https://example.com/wp-json/wc/v3/products \
  -u ck_1234567890abcdef:cs_1234567890abcdef

Using API Keys with HTTP

If your site only supports HTTP, pass credentials as query parameters:

HTTP is not secure. Credentials are transmitted in plain text and can be intercepted. Use HTTPS whenever possible.

curl http://example.com/wp-json/wc/v3/products \
  ?consumer_key=ck_1234567890abcdef \
  &consumer_secret=cs_1234567890abcdef

OAuth 1.0a Authentication

OAuth 1.0a is designed for third-party applications that need to access customer stores without storing passwords.

When to Use OAuth

Building a SaaS application
Creating marketplace integrations
Allowing multiple stores to connect
Need to revoke access without changing passwords

OAuth Flow

Request Token: Get temporary credentials
Authorization: Redirect user to approve access
Access Token: Exchange for permanent credentials
API Requests: Use access token for authentication

Implementation Example

const OAuth = require('oauth-1.0a');
const crypto = require('crypto');
const axios = require('axios');

const oauth = OAuth({
  consumer: {
    key: 'ck_1234567890abcdef',
    secret: 'cs_1234567890abcdef'
  },
  signature_method: 'HMAC-SHA256',
  hash_function(base_string, key) {
    return crypto
      .createHmac('sha256', key)
      .update(base_string)
      .digest('base64');
  }
});

const request_data = {
  url: 'https://example.com/wp-json/wc/v3/products',
  method: 'GET'
};

const headers = oauth.toHeader(oauth.authorize(request_data));

axios.get(request_data.url, { headers })
  .then(response => console.log(response.data))
  .catch(error => console.error(error));

OAuth Parameters

OAuth requests include these parameters:

oauth_consumer_key: Your consumer key
oauth_timestamp: Current Unix timestamp
oauth_nonce: Unique random string
oauth_signature: Request signature
oauth_signature_method: Usually HMAC-SHA256

Basic Authentication Plugin

For development and testing, you can use the Basic Authentication plugin.

Basic Authentication should ONLY be used for development/testing with HTTPS. Never use in production.

Installation

Download WooCommerce Basic Auth plugin
Install and activate the plugin
Use WordPress username and password for authentication

Example Request

curl https://example.com/wp-json/wc/v3/products \
  -u username:password

JWT Authentication

JSON Web Tokens provide stateless authentication with enhanced security.

Setup

Install a JWT authentication plugin:
- JWT Authentication for WP REST API
- Simple JWT Authentication
Configure your .htaccess or server to pass Authorization headers

Obtaining a Token

curl -X POST https://example.com/wp-json/jwt-auth/v1/token \
  -d "username=your_username" \
  -d "password=your_password"

Response:

{
  "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
  "user_email": "[email protected]",
  "user_nicename": "username",
  "user_display_name": "User Name"
}

Using the Token

curl https://example.com/wp-json/wc/v3/products \
  -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..."

Testing Authentication

Using Postman

Create a new request
Set URL: https://example.com/wp-json/wc/v3/products
Go to Authorization tab
Select Basic Auth
Enter Consumer Key as username
Enter Consumer Secret as password
Send request

Using Insomnia

Create a new request
Set URL: https://example.com/wp-json/wc/v3/products
Go to Auth tab
Select Basic Auth
Enter Consumer Key and Consumer Secret
Send request

Common Authentication Errors

401 Unauthorized

Cause: Invalid credentials or signature Solutions:

Verify Consumer Key and Consumer Secret are correct
Check that the user has appropriate permissions
Ensure credentials haven’t been revoked
Generate new API keys

Consumer Key is Missing

Cause: Server not parsing Authorization header correctly Solution: Pass credentials as query parameters:

https://example.com/wp-json/wc/v3/orders?consumer_key=ck_xxx&consumer_secret=cs_xxx

403 Forbidden

Cause: User lacks required permissions Solution:

Ensure the user has edit_posts capability
Check API key permissions (Read/Write)
Verify user role has appropriate capabilities

SSL Certificate Errors

Cause: Self-signed or invalid SSL certificate Solution for Testing Only:

Disable SSL verification (Postman/Insomnia settings)
Use proper SSL certificate in production

Security Best Practices

Follow these security guidelines to protect your store and customer data.

1. Always Use HTTPS

# Good
https://example.com/wp-json/wc/v3/products

# Bad - credentials transmitted in plain text
http://example.com/wp-json/wc/v3/products

2. Limit Key Permissions

Use Read permission for data retrieval only
Use Write permission only when necessary
Create separate keys for different integrations

3. Rotate Keys Regularly

Generate new keys periodically
Revoke old keys after migration
Monitor key usage in WooCommerce logs

4. Store Credentials Securely

// Good - Use environment variables
const API_KEY = process.env.WC_CONSUMER_KEY;
const API_SECRET = process.env.WC_CONSUMER_SECRET;

// Bad - Hardcoded credentials
const API_KEY = 'ck_1234567890abcdef';

5. Implement Rate Limiting

// Example: Rate limiting with retry logic
const makeRequest = async (url, retries = 3) => {
  try {
    return await api.get(url);
  } catch (error) {
    if (error.response?.status === 429 && retries > 0) {
      await new Promise(resolve => setTimeout(resolve, 1000));
      return makeRequest(url, retries - 1);
    }
    throw error;
  }
};

6. Validate SSL Certificates

# Good - Verify SSL certificates
import requests
response = requests.get(url, auth=auth, verify=True)

# Bad - Disabling SSL verification
response = requests.get(url, auth=auth, verify=False)

Authentication with FastCGI

If your server uses FastCGI, authorization headers may not be passed correctly.

Solution 1: Modify .htaccess

Add to your .htaccess file:

RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

Solution 2: Use Query Parameters

Pass credentials in the URL:

https://example.com/wp-json/wc/v3/products?consumer_key=ck_xxx&consumer_secret=cs_xxx

Webhook Authentication

When WooCommerce sends webhook requests to your application, it includes a signature for verification.

Verifying Webhook Signatures

const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const hash = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('base64');
  
  return hash === signature;
}

// Express.js middleware
app.post('/woocommerce-webhook', (req, res) => {
  const signature = req.headers['x-wc-webhook-signature'];
  const payload = JSON.stringify(req.body);
  
  if (!verifyWebhook(payload, signature, webhookSecret)) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process webhook
  res.sendStatus(200);
});

REST API

Store API

PHP APIs

Core Classes

​REST API Authentication

​Authentication Methods

​REST API Keys

​Generating API Keys

​Key Components

​Using API Keys with HTTPS

​Using API Keys with HTTP

​OAuth 1.0a Authentication

​When to Use OAuth

​OAuth Flow

​Implementation Example

​OAuth Parameters

​Basic Authentication Plugin

​Installation

​Example Request

​JWT Authentication

​Setup

​Obtaining a Token

​Using the Token

​Testing Authentication

​Using Postman

​Using Insomnia

​Common Authentication Errors

​401 Unauthorized

​Consumer Key is Missing

​403 Forbidden

​SSL Certificate Errors

​Security Best Practices

​1. Always Use HTTPS

​2. Limit Key Permissions

​3. Rotate Keys Regularly

​4. Store Credentials Securely

​5. Implement Rate Limiting

​6. Validate SSL Certificates

​Authentication with FastCGI

​Solution 1: Modify .htaccess

​Solution 2: Use Query Parameters

​Webhook Authentication

​Verifying Webhook Signatures

​Next Steps

Products API

Orders API

Build docs developers (and LLMs) love

REST API Authentication

Authentication Methods

REST API Keys

Generating API Keys

Key Components

Using API Keys with HTTPS

Using API Keys with HTTP

OAuth 1.0a Authentication

When to Use OAuth

OAuth Flow

Implementation Example

OAuth Parameters

Basic Authentication Plugin

Installation

Example Request

JWT Authentication

Setup

Obtaining a Token

Using the Token

Testing Authentication

Using Postman

Using Insomnia

Common Authentication Errors

401 Unauthorized

Consumer Key is Missing

403 Forbidden

SSL Certificate Errors

Security Best Practices

1. Always Use HTTPS

2. Limit Key Permissions

3. Rotate Keys Regularly

4. Store Credentials Securely

5. Implement Rate Limiting

6. Validate SSL Certificates

Authentication with FastCGI

Solution 1: Modify .htaccess

Solution 2: Use Query Parameters

Webhook Authentication

Verifying Webhook Signatures

Next Steps