If you want to connect WooCommerce with an external application, automation tool, reporting system, custom script, or another website, you may need WooCommerce REST API keys.
These keys act like credentials that allow another application to communicate with your store. Depending on the permissions you assign, the application might be able to read products and orders, create records, update information, or perform other actions through the API.
That makes API keys incredibly useful—but also something you should treat like passwords.
The safest approach is simple: create a separate key for each integration, give it only the permissions it actually needs, and store the credentials somewhere secure.
WooCommerce currently provides REST API key management under WooCommerce → Settings → Advanced → REST API.
What WooCommerce REST API Keys Are
The WooCommerce REST API allows external applications to communicate with WooCommerce using HTTP requests and JSON data. Developers can use it to work with store information such as products, orders, customers, coupons, and other WooCommerce resources.
Think of an API key as a digital access card. You give the card to a specific application, and WooCommerce uses it to determine whether that application is allowed to access certain resources.
Consumer Key vs. Consumer Secret
When you generate WooCommerce REST API credentials, WooCommerce provides two important values:
- Consumer Key
- Consumer Secret
The application generally uses these credentials when authenticating API requests.
The Consumer Secret is especially sensitive. WooCommerce states that the secret is displayed when the key is generated and is not available to view again after leaving the page.
How API Keys Connect External Apps
Imagine you have a custom inventory application that needs to retrieve WooCommerce products every hour.
Instead of giving the application your WordPress administrator password, you create a dedicated WooCommerce API key. The application uses those credentials to authenticate its API requests safely. This practice is a core building block of modern web workflows—to understand how these systems work together, read our complete guide on What is Wordpress Automation.
This creates a much cleaner separation between your WordPress account and the external integration.
Why WooCommerce API Key Security Matters
A WooCommerce API key isn't something you should casually paste into a public GitHub repository, browser-side JavaScript file, screenshot, or support forum.
Depending on the permissions and user associated with the key, an integration may have significant access to store data.
What Can Happen If a Key Leaks
If someone obtains an API credential, they may be able to make authenticated API requests as the associated WordPress user, subject to that user's capabilities and the key's permission level.
That could potentially expose private store information or allow unauthorized modifications.
Treat your Consumer Secret like you would treat a password: don't publish it, don't share it unnecessarily, and don't put it somewhere that other people can access it.
Why Read/Write Access Requires Extra Care
WooCommerce provides three permission levels:
- Read
- Write
- Read/Write
Read access allows an application to retrieve information. Write access allows it to create or modify information. Read/Write combines both capabilities.
If an integration only needs to retrieve product data, giving it Read/Write access is unnecessary.
That's like giving someone a master key when they only need to look through one room.
What You Need Before Creating an API Key
Before generating your credentials, make sure your WooCommerce installation is configured correctly.
WooCommerce documentation notes that the REST API requires appropriate WordPress/WooCommerce versions and that pretty permalinks must be enabled rather than the Plain permalink structure. HTTPS is also recommended.
WooCommerce and WordPress Requirements
Modern WooCommerce installations already include the REST API functionality. You do not normally need to install a separate WordPress REST API plugin.
If you're building a custom integration, however, always check the current WooCommerce developer documentation before choosing endpoints or authentication methods.
Why HTTPS and Permalinks Matter
Your API requests should use HTTPS, especially when authentication credentials are involved.
For example:
https://example.com/wp-json/wc/v3/products
is preferable to sending credentials over an unencrypted HTTP connection.
Your site's permalink configuration can also affect REST API functionality, so check Settings → Permalinks if API requests aren't working as expected.
Step 1 — Open the WooCommerce REST API Settings
The first step is straightforward.
Go to:
WordPress Dashboard → WooCommerce → Settings → Advanced → REST API
This is the current location documented by WooCommerce for creating and managing REST API keys.
Finding the REST API Screen
Look for the REST API section within the Advanced settings.
From there, you can create new keys and review existing credentials.
Understanding Existing Keys
Before creating another key, look at the credentials already present.
You may discover that an old integration is still active or that multiple keys have been created for the same service.
Don't create credentials blindly. Know what each existing key is used for.
Clear descriptions make this much easier to manage later.
Step 2 — Create a Descriptive API Key
Click Add Key or the equivalent create-key option.
You'll be asked to provide a description.
Don't enter something vague like:
API Key
Instead, use a description such as:
Google Sheets Inventory Sync
or:
CRM Order Import - Production
Choosing a Useful Description
A good description answers three questions:
- What application uses this key?
- What environment is it connected to?
- What is its purpose?
For example:
Zapier - Order Reporting - Production
is far more useful than:
Integration 2
Why Generic Key Names Are a Bad Idea
Six months from now, you may have ten integrations.
If your dashboard contains keys called:
- API Key 1
- API Key 2
- Test
- New Key
- Integration
you'll have a difficult time determining which credential can safely be revoked.
Good naming is a small security practice that prevents large management headaches later.
Step 3 — Select the Correct WordPress User
WooCommerce API keys are associated with a WordPress user. The requests made using the key conform to that user's WordPress roles and capabilities.
How User Permissions Affect API Access
This is an important part of the security model.
The API key isn't simply an independent password floating around your website. It is connected to a WordPress user.
Therefore, selecting the appropriate user matters.
When to Avoid Using Your Main Administrator
If an integration doesn't need administrator-level capabilities, don't automatically associate the key with your primary administrator account.
For a dedicated integration, consider using an appropriate WordPress user with only the capabilities required by the integration.
The principle is least privilege: give an application enough access to perform its job, but no more.
Step 4 — Choose the Minimum Required Permission
This is arguably the most important decision when creating your key.
WooCommerce provides Read, Write, and Read/Write permissions.
Read Access
Choose Read when the application only needs to retrieve information.
Examples include:
- Product reporting
- Inventory dashboards
- Data exports
- Analytics systems
- Read-only synchronization
If the application only needs to look at your store data, Read access should normally be your starting point.
Write Access
Write access is appropriate when the application needs to create or modify WooCommerce data.
For example, an automation that creates products may require write capabilities.
But don't select Write simply because it sounds more powerful.
Ask yourself what the application actually does.
Read/Write Access
Read/Write allows both retrieving and modifying data.
This may be required by synchronization tools that pull existing records and then update them.
However, it provides a broader attack surface than Read-only access.
If Read access is enough, don't grant Read/Write access.
Step 5 — Generate the WooCommerce API Keys
Once you've selected the description, user, and permissions, click Generate API Key.
WooCommerce will display the credentials.
Consumer Key
The Consumer Key identifies the API credential.
You will generally provide it to the application you're connecting.
Consumer Secret
The Consumer Secret authenticates the credential alongside the Consumer Key.
This is the value you need to protect most carefully.
WooCommerce explicitly warns that the secret is only shown when generated, so copy it and store it securely before leaving the screen.
Never assume you'll be able to return to this page later and reveal the secret again.
If you lose it, the practical solution is generally to create a replacement key.
Step 6 — Store Your API Credentials Securely
Generating a secure credential is only half the job.
You also need to store it safely.
Password Managers and Secret Managers
For manual credential storage, a reputable password manager can be a good option.
For applications and development environments, use environment variables or an appropriate secrets-management system whenever possible.
For example, instead of putting credentials directly inside source code, an application might load:
WC_CONSUMER_KEY
and
WC_CONSUMER_SECRET
from its protected environment configuration.
Places Where You Should Never Store Keys
Avoid placing API secrets in:
- Public GitHub repositories
- Front-end JavaScript
- Public Google Sheets
- Screenshots
- WordPress posts
- Public documentation
- Chat messages
- Support tickets
- Unprotected
.txtfiles
If a secret is visible to people who don't need it, assume it is compromised.
Step 7 — Connect the API to an External Application
After generating the credentials, you'll normally enter the information into your external application.
The exact fields depend on the software you're connecting.
API URL and Authentication
A typical WooCommerce REST API endpoint uses a URL structure similar to:
https://example.com/wp-json/wc/v3/products
The exact endpoint depends on what you want to retrieve or modify.
WooCommerce's developer documentation provides the current REST API endpoint and authentication guidance.
Testing the Connection
Don't immediately start a large synchronization.
First, test a simple request.
For example, if your integration is intended to retrieve products, start with a small product request.
A successful response tells you that the basic authentication and endpoint configuration are working.
How to Test a WooCommerce REST API Key Safely
Testing is where many developers make an avoidable mistake: they test a powerful Write or Read/Write key against production data without thinking about the consequences.
Testing a Read-Only Connection
If you're developing an application that only needs to read information, create a Read key first.
Test an endpoint that retrieves the required information.
This gives you a safer way to confirm that authentication works.
Checking API Responses
Look for:
- HTTP status codes
- JSON response structure
- Authentication errors
- Permission errors
- Missing fields
- Unexpected data
If the API returns a 401 or 403 response, don't immediately regenerate everything.
First determine whether the credentials, endpoint, user permissions, or authentication configuration is the problem.
Common WooCommerce API Key Security Mistakes
Even correctly generated API keys can become dangerous when they're handled poorly.
Sharing Keys in Chat or Email
Sending a Consumer Secret through ordinary chat or email creates unnecessary exposure.
If someone doesn't need the credential, don't send it to them.
Hard-Coding Secrets Into Public Code
This is one of the most common developer mistakes.
For example, putting the actual Consumer Secret directly into a publicly accessible PHP or JavaScript file is risky.
Use protected configuration or environment variables instead.
Giving Every Integration Read/Write Access
This is another common mistake.
Developers sometimes choose Read/Write because it makes integration easier.
But convenience shouldn't replace access control.
Permissions should be based on functionality, not convenience.
How to Rotate and Revoke WooCommerce API Keys
API credentials shouldn't live forever without review.
If an integration has been removed, revoke its key.
When to Revoke a Key
Consider revoking a key when:
- The integration is no longer used.
- A developer no longer needs access.
- The credential may have been exposed.
- The external application has been replaced.
- You don't know what the key is being used for.
- You suspect unauthorized API activity.
WooCommerce provides a Revoke Key option for generated credentials.
Replacing an Existing Credential
If you believe a secret has been leaked, don't simply hope nobody noticed.
Create a replacement credential, update the integration, test it, and then revoke the compromised key.
This approach minimizes downtime while removing the exposed credential.
WooCommerce REST API vs. WordPress Application Passwords
WooCommerce REST API keys aren't the only authentication mechanism available in the WordPress ecosystem.
WordPress also supports Application Passwords, which are designed for programmatic authentication without sharing a user's primary password.
When WooCommerce API Keys Make Sense
WooCommerce REST API keys are a natural choice when you're specifically integrating with WooCommerce's REST API and the external application expects WooCommerce Consumer Key and Consumer Secret credentials.
They're particularly convenient for store integrations and WooCommerce-specific applications.
When Application Passwords May Be More Appropriate
WordPress Application Passwords can be useful for integrations that authenticate against the broader WordPress REST API.
They are individually revocable and are shown only when created. WordPress also recommends using HTTPS when sending these credentials because Basic Authentication without encryption would expose credentials in transit.
The important point is to choose authentication based on the API you're actually using.
Security Checklist for WooCommerce API Keys
Before you finish your integration, run through this quick checklist.
Before Generating a Key
- Is HTTPS enabled?
- Do you know which application needs access?
- Does the application really need API access?
- Which WordPress user should own the credential?
- Does it need Read, Write, or Read/Write?
- Can you use a dedicated integration user?
After Connecting an Integration
- Store the Consumer Secret securely.
- Don't expose credentials in front-end code.
- Don't commit secrets to Git.
- Use descriptive key names.
- Test with the smallest necessary operation.
- Review unused keys regularly.
- Revoke credentials that are no longer needed.
- Replace exposed credentials immediately.
Final Thoughts
Creating WooCommerce REST API keys is easy. Creating them safely requires a little more thought.
The best approach isn't complicated: use HTTPS, create separate credentials for separate integrations, choose the correct WordPress user, apply the principle of least privilege, and protect the Consumer Secret like a password.
If your application only needs to read products, don't give it Read/Write access. If an integration is no longer being used, revoke its key. And if a credential becomes exposed, replace it instead of taking chances.
A few minutes of careful API configuration can prevent a much bigger security problem later.
For the latest WooCommerce implementation details, refer to the official WooCommerce REST API documentation and WooCommerce REST API merchant documentation.
Frequently Asked Questions
Can I use one WooCommerce API key for multiple applications?
You technically may be able to reuse credentials, but it is generally better security practice to create separate credentials for separate integrations.
If every application uses the same key, you lose useful separation. If one application is compromised, you may need to replace the credential everywhere.
One integration, one credential is usually easier to manage and revoke.
Should I use Read or Read/Write access?
Use the lowest permission level that satisfies the integration.
If an application only retrieves products, orders, or other information, Read may be sufficient.
If it needs to create or modify records, it may require Write or Read/Write access.
Can I see the Consumer Secret again after creating the key?
No. WooCommerce documents that the Consumer Secret is shown when the key is generated and is not available to view again after leaving the page.
That's why you should store it securely immediately.
What should I do if my WooCommerce API key is exposed?
Treat it as compromised.
Create a replacement credential, update the application with the new credentials, verify that the integration works, and then revoke the exposed key.
If you suspect broader unauthorized access, also investigate your server, WordPress users, application logs, and other credentials.
Do WooCommerce API keys expire automatically?
WooCommerce's REST API key interface provides management and revocation controls, but you should not rely on automatic expiration as your primary security strategy.
Instead, maintain an inventory of your integrations and periodically review whether each credential is still necessary.
Can I put WooCommerce API keys directly in JavaScript?
You should avoid exposing sensitive API credentials in browser-side JavaScript.
Anything delivered to a visitor's browser should be considered potentially visible to that visitor.
For sensitive WooCommerce operations, keep authentication credentials on a trusted server-side component whenever possible.
Are WooCommerce API keys the same as my WordPress password?
No.
WooCommerce REST API keys are separate credentials associated with a WordPress user and used for API access. WordPress also has a separate Application Password feature for programmatic authentication.
Keeping these mechanisms separate is one reason you should never give an external application your normal WordPress login password.
Comments
Post a Comment