WooCommerce API Keys: A Complete UK Guide (2026)
16 August 2026
Learn how to create, use and secure WooCommerce API keys for your UK store. Covers GDPR, VAT extensions, Xero integration and more.
What Are WooCommerce API Keys?
WooCommerce API keys are authentication credentials that let external applications securely access your store’s data. Each key set includes a consumer key and a consumer secret, much like a username and password. They allow you to connect your WooCommerce store to third-party services such as accounting software, CRM systems, or custom mobile apps. In the UK, this is especially useful for automating VAT calculations or syncing stock with marketplaces like Amazon UK. API keys work with the WooCommerce REST API, enabling read and write operations on products, orders, customers, and more. Importantly, you can assign permissions – read only, write only, or read/write – to control what each connected app can do.
How to Generate WooCommerce API Keys for Your UK Store
Generating API keys in WooCommerce is straightforward. From your WordPress admin dashboard, go to WooCommerce > Settings > Advanced > REST API. Click 'Add Key' and give it a description that helps you identify the integration – for example 'Xero sync' or 'TikTok feed'. Next, select the user you want the key to be assigned to, usually the site administrator. Then choose the permissions level: read-only for analytics tools, read/write for full integrations. After that, click 'Generate API Key' and you’ll be given the consumer key and secret. Copy them immediately because the secret is only shown once. Store them somewhere secure, such as a password manager, as they provide direct access to your store data.
Top UK Use Cases for WooCommerce API Keys
UK retailers often use WooCommerce API keys to streamline operations. A common integration is with accounting software like Xero or Sage to automatically sync orders, invoices, and VAT figures – crucial for Making Tax Digital (MTD) compliance. You can also connect API keys to multi-channel selling platforms to sync inventory across eBay, Amazon UK, or your own marketplace. Marketing automation tools use read-only keys to pull customer purchase history, helping you build GDPR-compliant email segments. Similarly, custom parcel shipping plugins can use API keys to fetch live order data and generate Royal Mail or DPD labels. The possibilities are vast, and with proper permissions, they keep your data safe while saving hours of manual work.
Security Best Practices for UK Businesses
Because API keys give direct access to your WooCommerce data, security is paramount, especially under UK GDPR rules. Start by always using HTTPS on your site to encrypt API traffic in transit. Only grant the minimum permissions needed – a read-only key for analytics should never be able to modify products or orders. Use unique keys for each application, so you can revoke one without affecting others. Store keys outside your web root, never inside code repositories or front-end JavaScript. Additionally, consider implementing IP-based restrictions if your API provider supports them, and regularly rotate keys every six months. Finally, routinely audit your keys in the REST API settings and immediately delete any that seem unfamiliar or no longer in use.
Troubleshooting Common API Key Issues
If you’re having trouble with your WooCommerce API keys, there are a few usual culprits. A 401 error means your consumer key and secret don’t match – check for extra spaces or incomplete pasting. A 404 error often indicates the API endpoint is incorrect or you haven’t added the key correctly. Also, ensure the user you assigned the key to still exists and has the right WordPress capabilities. In the UK, timezone or date formatting may affect order queries, so pass UTC dates as required. If a key was working and suddenly isn’t, it may have been revoked. Always test an endpoint using a tool like Postman or curl, and remember that WooCommerce's API uses basic authentication over HTTPS with your consumer key as the username and secret as the password.
FAQ
You can find and manage WooCommerce API keys under WooCommerce > Settings > Advanced > REST API. From there, you can add, edit, or revoke keys. This is the central dashboard for all API access to your store.