How to Automate WordPress Ecommerce Orders using the API

Understanding the WooCommerce REST API

Setting Up WooCommerce API Authentication

WooCommerce REST API keys are completely separate from WordPress user accounts. Generate a key pair at WooCommerce > Settings > Advanced > REST API. Set permissions to 'Read/Write' for order automation. The consumer_secret is shown only once at generation time — copy it immediately.

1. 1Log into wp-admin and go to WooCommerce > Settings
2. 2Click the 'Advanced' tab, then 'REST API'
3. 3Click 'Add Key', enter a description (e.g., 'Order Automation'), set user to an admin, permissions to 'Read/Write'
4. 4Click 'Generate API Key'
5. 5Copy both the Consumer Key (ck_...) and Consumer Secret (cs_...) — the secret is shown only once
6. 6Set environment variables: WC_CONSUMER_KEY and WC_CONSUMER_SECRET
7. 7Test: curl 'https://yoursite.com/wp-json/wc/v3/orders?status=processing' -u ck_xxx:cs_xxx

1import os
2import requests
3
4WP_BASE = os.environ['WP_BASE_URL']  # e.g. https://yoursite.com/wp-json
5WC_KEY = os.environ['WC_CONSUMER_KEY']     # ck_...
6WC_SECRET = os.environ['WC_CONSUMER_SECRET']  # cs_...
7WC_AUTH = (WC_KEY, WC_SECRET)
8
9# Verify connection
10resp = requests.get(f'{WP_BASE}/wc/v3/orders?per_page=1', auth=WC_AUTH)
11print('WooCommerce API connected:', resp.status_code == 200)

Key endpoints

1[{"id":1001,"status":"processing","billing":{"first_name":"Jane","last_name":"Doe","email":"jane@example.com"},"line_items":[{"name":"Product A","quantity":2,"total":"49.98"}],"total":"49.98","date_created":"2026-05-07T10:00:00"}]

1{"id":1001,"status":"processing","payment_method":"stripe","billing":{"first_name":"Jane","email":"jane@example.com","address_1":"123 Main St","city":"Boston","state":"MA","postcode":"02101"},"line_items":[{"id":5,"name":"Product A","sku":"PROD-A","quantity":2,"total":"49.98"}],"shipping_lines":[{"method_title":"Flat Rate","total":"5.00"}],"total":"54.98"}

1{"status":"completed"}

1{"id":1001,"status":"completed","date_completed":"2026-05-07T12:00:00"}

Step-by-step automation

1# Create webhook via API
2curl -X POST 'https://yoursite.com/wp-json/wc/v3/webhooks' \
3  -u 'ck_YOUR_KEY:cs_YOUR_SECRET' \
4  -H 'Content-Type: application/json' \
5  -d '{
6    "name": "Order Created",
7    "topic": "order.created",
8    "delivery_url": "https://yourapp.com/webhooks/woocommerce",
9    "secret": "YOUR_WEBHOOK_SECRET"
10  }'

1curl -X GET 'https://yoursite.com/wp-json/wc/v3/orders/1001' \
2  -u 'ck_YOUR_KEY:cs_YOUR_SECRET'

1curl -X PUT 'https://yoursite.com/wp-json/wc/v3/orders/1001' \
2  -u 'ck_YOUR_KEY:cs_YOUR_SECRET' \
3  -H 'Content-Type: application/json' \
4  -d '{"status":"completed","customer_note":"Your order has been shipped. Tracking: 1Z999AA10123456784"}'

1# Example: Create shipment in ShipStation
2curl -X POST 'https://ssapi.shipstation.com/orders/createshipment' \
3  -H 'Authorization: Basic BASE64_SHIPSTATION_CREDS' \
4  -H 'Content-Type: application/json' \
5  -d '{"orderId": 12345, "carrierCode": "fedex", "serviceCode": "fedex_ground"}'

Complete working code

Complete WooCommerce order webhook handler: verifies HMAC-SHA256 signature, processes 'processing' orders, re-fetches for fresh data, calls a shipping service, updates order status to 'completed' with tracking note. Handles retries for transient failures.

1import os
2import hmac
3import hashlib
4import base64
5import threading
6import requests
7from flask import Flask, request, jsonify
8
9app = Flask(__name__)
10
11WP_BASE = os.environ['WP_BASE_URL']
12WC_AUTH = (os.environ['WC_CONSUMER_KEY'], os.environ['WC_CONSUMER_SECRET'])
13WEBHOOK_SECRET = os.environ['WC_WEBHOOK_SECRET']
14
15def verify_sig(body: bytes, sig: str) -> bool:
16    expected = base64.b64encode(hmac.new(WEBHOOK_SECRET.encode(), body, hashlib.sha256).digest()).decode()
17    return hmac.compare_digest(expected, sig)
18
19def wc_get(path):
20    resp = requests.get(f'{WP_BASE}{path}', auth=WC_AUTH)
21    resp.raise_for_status()
22    return resp.json()
23
24def wc_put(path, payload):
25    resp = requests.put(f'{WP_BASE}{path}', auth=WC_AUTH,
26                        headers={'Content-Type': 'application/json'}, json=payload)
27    resp.raise_for_status()
28    return resp.json()
29
30def get_tracking_number(order):
31    # Replace with your shipping API integration
32    return f"TRACK{order['id']:08d}"
33
34def process_order(order_payload):
35    order_id = order_payload['id']
36    if order_payload.get('status') != 'processing':
37        return
38    try:
39        order = wc_get(f'/wc/v3/orders/{order_id}')
40        if order['status'] != 'processing':
41            return
42        tracking = get_tracking_number(order)
43        wc_put(f'/wc/v3/orders/{order_id}', {
44            'status': 'completed',
45            'customer_note': f'Shipped! Tracking: {tracking}'
46        })
47        print(f'Order {order_id} completed, tracking: {tracking}')
48    except Exception as e:
49        print(f'Error processing order {order_id}: {e}')
50
51@app.route('/webhooks/woocommerce', methods=['POST'])
52def webhook():
53    raw = request.get_data()
54    sig = request.headers.get('X-WC-Webhook-Signature', '')
55    if not verify_sig(raw, sig):
56        return jsonify({'error': 'bad sig'}), 401
57    order = request.json
58    threading.Thread(target=process_order, args=(order,), daemon=True).start()
59    return jsonify({'ok': True})
60
61if __name__ == '__main__':
62    app.run(port=3000)

Error handling

Rate Limits for WooCommerce REST API

1import time
2import requests
3
4def wc_request(method, url, auth, max_retries=5, **kwargs):
5    for attempt in range(max_retries):
6        resp = getattr(requests, method)(url, auth=auth, **kwargs)
7        if resp.status_code == 429:
8            wait = int(resp.headers.get('Retry-After', 2 ** attempt))
9            time.sleep(wait)
10            continue
11        return resp
12    raise Exception('Max retries exceeded')

• Process webhook events asynchronously — return 200 immediately and process in a background thread
• Re-fetch orders from the API for authoritative state rather than relying solely on webhook payload data
• Update order status only AFTER the shipping API succeeds to prevent marking orders complete if shipping fails
• Add 500ms delays between sequential order processing calls when doing batch backfills
• Monitor the X-WP-Total header when listing orders to understand pagination requirements

Security checklist

Automation use cases

No-code alternatives

Don't want to write code? These platforms can automate the same workflows visually.

Best practices

• Verify X-WC-Webhook-Signature with base64-encoded HMAC-SHA256 on every webhook — this prevents processing forged orders
• Re-fetch the order via GET /wc/v3/orders/{id} in the webhook handler for the authoritative state
• Only process orders in 'processing' status — 'pending' orders have not been paid
• Update order status to 'completed' only after your shipping/fulfillment step succeeds
• Handle all order statuses: if an order is 'cancelled' in the re-fetch, abort processing
• Log order_id, shipping tracking numbers, and status changes for support and debugging
• Test the full webhook flow with a real WooCommerce test order before going live

Ask AI to help

Copy one of these prompts to get a personalized, working implementation.

Related automations