WooCommerce REST API

WordPress permalinks must be set to something that is easily human readable at: Settings > Permalinks.

Day and name is a great default, but anything aside from Plain should work

The WooCommerce REST API works on a key system to control access. These keys are linked to WordPress users on your website.

To create or manage keys for a specific WordPress user:

1. Go to: WooCommerce > Settings > Advanced > REST API.
   Note: Keys/Apps was found at WooCommerce > Settings > API > Key/Apps prior to WooCommerce 3.4.
2. Select Add Key. You are taken to the Key Details screen.
   
3. Add a Description.
4. Select the User you would like to generate a key for in the dropdown.
5. Select a level of access for this API key — Read access, Write access or Read/Write access.
6. Select Generate API Key, and WooCommerce creates API keys for that user.

Now that keys have been generated, you should see Consumer Key and Consumer Secret keys, a QRCode, and a Revoke API Key button.

The Consumer Key and Consumer Secret may be entered in the application using the WooCommerce API, and the app should also request your URL.

Use this step-by-step guide here on how to do that.

To enable the legacy REST API within WooCommerce, go to WooCommerce > Settings > Advanced > Legacy API and tick the Enable the legacy REST API checkbox.

Note: legacy REST API was found at WooCommerce > Settings > API prior to WooCommerce 3.4.

Legacy REST API is deprecated and should be removed from WooCommerce soon, as an alternative there’s a new REST API that integrates the WordPress REST API, this is the WooCommerce current REST API and it’s also enabled by default.

Find the REST API documentation at: WooCommerce REST API Docs.

• Node.js
• Python
• PHP
• Ruby

As the first step, make sure that you are using the correct API keys.

If the keys are correct, make sure that the keys have correct permissions (If you are reading and writing data, then make sure the permission is set to “Read/Write”)

If the above is set correctly, then make sure your server is passing the auth headers to WordPress. You can test this by passing in the consumer key and secret via URL rather than headers to confirm the issue. Eg:

https://www.yoursitename.com/wp-json/wc/v3/orders?consumer_key=XXXX&consumer_secret=XXXX

If you have access to .htaccess file then add the below lines temporarily for the test

SetEnvIf Authorization .+ HTTP_AUTHORIZATION=$0
RewriteRule ^wp-json/.* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]