How do I create WooCommerce REST API keys?
Go to WooCommerce > Settings > Advanced > REST API in WP admin and select Add Key. Enter a description, pick the WordPress user the key acts as, set Permissions to Read/Write, and select Generate API Key. The consumer secret is shown only once, so copy it before you leave the page.
Set permalinks first
WooCommerce tells you to check this before you generate anything: your WordPress permalinks must be set to a human readable format, meaning any option other than Plain. Plain permalinks break the /wp-json/ routes the key authenticates against, so a key issued on a Plain-permalink site looks valid and fails on the first request.
Open Settings > Permalinks in WP admin.
Select any option other than Plain, for example Post name.
Save changes, then load /wp-json/wc/v3/ in a browser to confirm the route answers.
Generate the key
Go to WooCommerce > Settings > Advanced > REST API.
Select Create an API key, or Add Key if keys already exist.
Enter a Description that names the app the key is for, so you can revoke the right one later.
Select the User you want to generate the key for from the dropdown.
Set Permissions to Read/Write for a shipping app that has to read orders and write back.
Select Generate API Key, then copy the consumer key and consumer secret.
The screen also shows a QR code and a Revoke Key link. The consumer secret is not recoverable: if you lose it, revoke the key and generate a new one.
Which permission level to pick
A Read key cannot update an order, so a shipping app given one imports your queue and then fails at write-back time. Read/Write is the level that covers both reading orders and setting one to completed with tracking.
| Permission | What WooCommerce allows | Use it for |
|---|---|---|
| Read | Retrieve data from your store | Reporting or an export that never changes an order |
| Write | Create and update data in your store | A one-way writer, rare on its own |
| Read/Write | Both read and write access | A shipping app that pulls orders and writes tracking back |
What the key is tied to
The key is issued against the WordPress user you selected, not against your site in general. Give two apps two keys with two descriptions, so revoking one costs you nothing on the other. The consumer key and secret together are full API access at the permission level you chose, so keep the pair out of email and shared documents.
Test the pair before you paste it anywhere
Over HTTPS the WooCommerce REST API takes HTTP basic auth, with the consumer key as the username and the consumer secret as the password. One authenticated GET against the orders route tells you whether the key, the permalinks and the server are all in order.
Request https://yourstore.com/wp-json/wc/v3/orders with basic auth, key as username, secret as password.
A JSON array of orders means the pair works.
A 404 with rest_no_route means permalinks, not the key.
A 401 saying the consumer key is missing usually means your server stripped the Authorization header.
Revoke and reissue
The REST API screen lists every key with its description, the user and the last access. Select Revoke Key to kill one immediately. Any app holding the old pair stops working the moment you revoke, so generate the replacement first if you want no gap.
Key takeaways
- Path: WooCommerce > Settings > Advanced > REST API > Add Key.
- Permalinks must be set to something other than Plain before the key will work.
- Read/Write is the level a shipping app needs to write tracking back.
- The consumer secret is shown once, and the Revoke Key link is on the same screen.
Where the key goes in I'd Ship That
I'd Ship That for WooCommerce is in early access, and the connection is REST API keys, not something installed on your site. You paste your site URL with the consumer key and secret, we verify the pair, then paid orders land in The Workbench on a scheduled sync. Rates are priced across USPS and UPS, and buying the label sets the order to completed, writes the tracking number and provider, and adds a customer-visible order note.
Related questions
No. The REST API screen is part of WooCommerce, at WooCommerce > Settings > Advanced > REST API. You generate the key there and hand the consumer key and secret to the app that needs it.
No. WooCommerce shows the consumer secret only once, on the screen right after you select Generate API Key. If it is lost, use Revoke Key on that key and generate a replacement.
Pick a user whose access you are comfortable handing to the app, and give the key a description that names the app. Keys are listed per user, so a descriptive name is what lets you revoke the right one months later.
Basic auth with the key and secret is the HTTPS method. Over HTTP the WooCommerce REST API requires OAuth 1.0a one-legged authentication instead, which is one more reason to serve the store over HTTPS.