Does a shipping app need a plugin on my WooCommerce site?
It does not have to. WooCommerce exposes a REST API at /wp-json/wc/v3/, so an outside app can read orders and update them using a consumer key and secret you generate in WP admin. I'd Ship That connects that way: site URL plus a Read/Write key, with nothing added to your WordPress install and access revoked from your own settings screen.
Two ways an app can reach your orders
Both are legitimate. The difference is where the risk sits. Installed code runs inside your site on every request and has to stay compatible with WordPress, WooCommerce and your other extensions. A key is a credential you issued, scoped to a permission level, and killing it is one click.
| Approach | What lands on your site | How you cut access |
|---|---|---|
| Code installed on WordPress | Files and database changes you now maintain and update | Deactivate and delete it |
| REST API keys | Nothing. A consumer key and secret issued in WP admin | Select Revoke Key on that key |
What the REST connection can do
That set is enough to run shipping end to end: pull what is paid, print the label elsewhere, then write the status, the tracking meta and a customer-visible note back onto the order.
| Action | Route |
|---|---|
| Read the queue by status | GET /wp-json/wc/v3/orders |
| Read one order in full | GET /wp-json/wc/v3/orders/{id} |
| Update status and meta | PUT /wp-json/wc/v3/orders/{id} |
| Add a note the customer sees | POST /wp-json/wc/v3/orders/{id}/notes |
What the key does not give away
The permission you picked is the ceiling. A Read key cannot change anything on the store, and a Read/Write key is still bounded by the REST API routes, not by direct database access. It is also traceable: the REST API screen lists each key by description with the user it belongs to and its last access.
WooCommerce's own label option is an extension
For comparison, WooCommerce publishes a free WooCommerce Shipping extension that prints USPS, UPS and DHL Express labels from inside WP admin. That one is installed on your site, because it renders inside your dashboard. An outside app that only reads and writes orders does not need to be.
Before you connect anything
Set permalinks to any option other than Plain, or the REST routes return 404.
Serve the store over HTTPS, so the key and secret can travel as basic auth.
Generate a Read/Write key with a description naming the app.
Test with one authenticated GET to /wp-json/wc/v3/orders before you paste the pair anywhere.
Keep the Revoke Key link in mind: it is how you end the relationship.
Key takeaways
- WooCommerce's REST API at /wp-json/wc/v3/ is the connection, and it needs nothing installed.
- A consumer key and secret, scoped Read or Read/Write, is the whole credential.
- Revoke Key on the REST API screen ends access immediately.
- WooCommerce's own free WooCommerce Shipping extension prints USPS, UPS and DHL Express labels.
How I'd Ship That connects
I'd Ship That for WooCommerce is in early access. You paste your site URL with a REST API consumer key and secret, and we verify the pair; nothing is installed on your WordPress site.
Processing and on-hold orders arrive in The Workbench on a scheduled sync, rates are priced across USPS and UPS, and buying a label sets the order to completed with tracking meta and a customer-visible note. We do not read products or inventory, and we do not split an order into partial shipments.
Related questions
It is different rather than slower. An outside app polls your store on a schedule instead of reacting inside the request that created the order, so orders appear in a window rather than the same second. For packing work measured in minutes, that window is not the bottleneck.
The wc/v3 namespace is a versioned public API, which is exactly why integrations target it. Installed code has to be kept compatible with each release, and WooCommerce puts that burden on the extension developer.
Choose the permission level when you generate the key. Read lets an app retrieve data only, and Read/Write lets it create and update. Issue one key per app so revoking one does not disturb the others.
Requests from that app stop authenticating immediately. Orders already imported stay wherever the app holds them, but nothing further is read from or written to your store until you issue a new key.