WooCommerce
Connect WooCommerce to manage products, orders, customers, coupons, and sales reports for your store.
You end up pasting your store's home URL plus a WooCommerce REST API Consumer key (ck_...) and Consumer secret (cs_...) generated in WooCommerce > Settings > Advanced > REST API.
- Setup time
- 4 min
- Auth
- API credentials
- API base URL
- https://YOUR-STORE.com/wp-json/wc/v3
- Rate limits
- WooCommerce core does not publish an API rate limit. Throughput is bounded by your own WordPress host, and managed hosts or security plugins such as Wordfence may add their own throttling.
Before you begin
- A self-hosted WordPress site with the WooCommerce plugin active (WooCommerce 3.4 or later)
- A WordPress user with the Administrator role, because the Advanced settings tab is admin-only
- The store served over HTTPS, otherwise the REST API refuses Basic Auth credentials
- Pretty permalinks enabled (Settings > Permalinks set to anything other than Plain) so /wp-json/ resolves
Get your credentials
Turn on pretty permalinks
Go to Settings > Permalinks, choose Post name, and click Save Changes. Then load https://YOUR-STORE.com/wp-json/wc/v3 in a browser and check that JSON comes back rather than a 404 page.
Open the WooCommerce REST API key list
In the WordPress sidebar click WooCommerce > Settings, open the Advanced tab, then click the REST API section.
REST API
Keys and applications that can read or write to this store over the REST API.
| Description | Consumer key ending in | User | Permissions | Last access |
|---|---|---|---|---|
| Legacy import scriptCreated Jan 12, 2026 | …4d1c | admin | Read | Mar 4, 2026 |
| Storefront widgetCreated Feb 2, 2026 | …8b73 | admin | Read/Write | Mar 6, 2026 |
An empty list here means no keys have been created yet.
Create a Read/Write key
Click Add key, type a Description, leave User on your administrator account, and set Permissions to Read/Write. Click Generate API key.
Key details
The key inherits the capabilities of the WordPress user you select.
Permissions offers Read, Write and Read/Write. PopMCP needs Read/Write.
Copy the consumer key and consumer secret
Copy Consumer key and Consumer secret from the results screen before you navigate away. Click Copy beside each value.
Key details
- Consumer key
- ck_****9f2a
- Consumer secret
- cs_****7b41
- QR Code
- Scan to load both values into a mobile app
The secret is displayed exactly once.
Paste the three values into PopMCP
Set Store URL to your store's home URL with no trailing path, for example https://YOUR-STORE.com. Paste the Consumer key and Consumer secret, then save.
Connect in PopMCP
Open your workspace, choose WooCommerce in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Store URLtext | Your store's home URL. The WooCommerce REST API lives under /wp-json/wc/v3. |
| Consumer keytext | WooCommerce → Settings → Advanced → REST API → Add key, with Read/Write permissions. |
| Consumer secretsecret | The secret shown once when you created the WooCommerce REST API key. Powers products, orders, and customers. Stored encrypted.Encrypted with AES-256-GCM on save and never shown again. |
PopMCP verifies the credential against WooCommerce immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP shows the WooCommerce connector as Connected and a test call lists your store's products. The key's row in WooCommerce > Settings > Advanced > REST API updates its Last access column to today.
Troubleshooting
401 woocommerce_rest_cannot_view or "Consumer key is invalid"
Why: The key was pasted with a trailing space, or the store is on plain HTTP so the Authorization header is stripped.
Fix: Re-copy both values and confirm the Store URL starts with https://. If your host strips Authorization headers, add the standard WordPress SetEnvIf or RewriteRule for HTTP_AUTHORIZATION to .htaccess.
404 rest_no_route on /wp-json/wc/v3
Why: Permalinks are set to Plain, or WooCommerce is deactivated.
Fix: Set Settings > Permalinks to Post name, click Save Changes to flush rewrite rules, and confirm WooCommerce is active under Plugins.
403 woocommerce_rest_authentication_error on writes
Why: The key was created with Read permissions, or the linked WordPress user is not an administrator.
Fix: Revoke the key and create a new one with Permissions set to Read/Write against an administrator account.
There is no REST API section under Advanced
Why: The store runs WooCommerce older than 3.4, where keys lived under WooCommerce > Settings > API > Keys/Apps.
Fix: Update WooCommerce, or create the key on the old API tab. The generated key works the same either way.
Consumer secret was lost after closing the page
Why: WooCommerce displays the secret only once, at generation time.
Fix: Click Revoke key on that row and generate a fresh key. There is no way to re-display an existing secret.