WooCommerce REST API Keys: A UK Merchant's Guide for 2026
17 August 2026
Learn how to create and secure WooCommerce REST API keys for your UK store. Step-by-step guide, best practices, and common uses in 2026.
What Are WooCommerce REST API Keys?
WooCommerce REST API keys are credentials that allow external applications to securely interact with your store’s data. They authenticate requests to your site’s REST endpoints, enabling you to read orders, update products, manage customers, and more. For UK merchants, these keys are essential for connecting your store to third-party services like accounting software, ERP systems, or custom integrations. Each key set includes a Consumer Key and Consumer Secret, similar to a username and password pair. You control permissions (read, write, or read/write) so you can limit access. Understanding how they work is the first step toward automating your eCommerce operations safely.
How to Generate API Keys in WooCommerce
To generate API keys, log into your WordPress admin. Navigate to WooCommerce > Settings > Advanced > REST API. Click 'Add Key'. Give it a description (e.g., 'Xero sync'), select the user (usually the store admin) and set permissions—typically 'Read/Write' for full integration. Click 'Generate API Key'. You’ll be shown the Consumer Key and Consumer Secret once; copy them immediately as they won’t be displayed again. These keys are used with the store’s domain to form the API endpoint URL, like https://yourstore.co.uk/wp-json/wc/v3/. Always store the secret securely, as it grants access to your store data.
Best Practices for Securing Your API Keys
Your WooCommerce REST API keys are as powerful as your admin login, so treat them with care. Never embed them in client-side code or share them via email. Use environment variables or a secure secrets manager on your server. Restrict access by IP address if your integration provider supports it. Always assign the least privilege needed—if an application only reads orders, use 'Read' permissions, not 'Read/Write'. For UK GDPR compliance, ensure any third-party processing this data has signed a Data Processing Agreement. Regularly review your keys in the WooCommerce REST API settings and revoke any that are unused or suspicious.
Common UK Use Cases for WooCommerce API Keys
UK merchants often use REST API keys to integrate with accounting tools like Xero, QuickBooks, or Sage to automate VAT returns and HMRC MTD submissions. Shipping integrations with Royal Mail, DPD, or DHL rely on API keys to fetch orders and print labels automatically. Inventory management systems sync stock levels across channels like Amazon and eBay using the API. You can also build custom dashboards to monitor sales analytics or connect to a CRM. Some use the API to automate GDPR data requests, pulling customer data on demand. These integrations save hours of manual work while reducing errors.
Troubleshooting API Key Issues
If you're getting authentication errors (like 'Consumer key is missing' or 'Invalid signature'), check that the key and secret are correctly copied with no extra spaces. Ensure the user associated with the key hasn't been deleted or changed permissions. Verify the endpoint URL matches your site's permalink structure. If you use a caching plugin, sometimes it may interfere with requests. In the UK, if you have a staging site, remember that keys are site-specific. Also, check your server's PHP error logs and ensure the REST API is not disabled by a security plugin. If issues persist, regenerate the key and update the integration.
FAQ
You can manage your keys in the WordPress dashboard under WooCommerce > Settings > Advanced > REST API. Here you can add, view, or revoke keys. The actual key value is only displayed once at generation, so you'll need to regenerate if lost.