Skip to main content

​
Connect WooCommerce end to end

WooCommerce is the self-hosted WordPress e-commerce option in the Integrations catalog. Unlike the OAuth-backed entries (Shopify, HubSpot), WooCommerce connects with a REST API key pair — you generate a consumer key and consumer secret in WordPress admin and paste them into a dialog. No consent screen, no redirect. This guide walks the whole flow: generating the key pair, connecting, understanding what syncs, building messaging flows off the events, and revoking cleanly when you’re done.
The connect step is owner/admin only — it’s the only step that touches store credentials. Everything after connect (syncs, event ingest) is automatic.

​
1. Where to find it

Open Settings → Integrations. In the discovery sidebar pick Ecommerce — the WooCommerce card sits alongside Shopify. The card’s CTA reads Paste API key, not “Connect,” because there is no OAuth consent step for this integration.

​
2. What does it do?

Once connected, Orbit syncs your WooCommerce customers, orders, and products on a scheduled poll and ingests them into your contact list and CDP event stream. Two messaging patterns become available immediately:
  • Post-purchase flows — order created / updated events land as woocommerce.order events you can trigger on (thank-you, review request, fulfillment follow-up) over SMS or WhatsApp.
  • Abandoned-cart recovery — checkout/cart events let you fire a drip with a recovery link, over SMS or WhatsApp.

​
3. Generate the consumer key pair in WordPress

Do this first, in the WordPress admin of the store you want to connect:
  1. In WordPress admin, go to WooCommerce → Settings → Advanced → REST API.
  2. Click Add key.
  3. Give the key a description (e.g. “Orbit”), pick the WP user it will run as, and set Permissions to Read/Write.
  4. Click Generate API key. WordPress shows the Consumer key (starts with ck_) and Consumer secret (starts with cs_) — shown exactly once. Copy both before leaving the page.
Store readiness checklist — the v3 REST API needs all of these:
  • WooCommerce 3.6 or newer (the v3 API namespace the integration probes).
  • Permalinks set to a “pretty” mode (Settings → Permalinks — anything except Plain). With Plain permalinks the REST endpoints return 404.
  • HTTPS on the storefront. The consumer secret never travels over plain HTTP; connect rejects http:// URLs.
  • The REST API must be reachable over the public internet (no maintenance-mode plugin or IP allow-list blocking /wp-json/).

​
4. Connect with Paste API key

  1. In Settings → Integrations, click Paste API key on the WooCommerce card.
  2. The connect dialog asks for three values:
    • Store URL — the full storefront origin, e.g. https://store.example.com. Must be HTTPS.
    • Consumer key — the ck_ value from Step 3.
    • Consumer secret — the cs_ value from Step 3 (entered into a masked password field).
  3. Expand Where do I find these? inside the dialog if you need the WP admin path again — it restates the exact WooCommerce → Settings → Advanced → REST API steps.
  4. Click Connect. Orbit validates the pair against your store by calling GET /wp-json/wc/v3/orders?per_page=1, and only stores the key pair when that probe returns success. Both halves are encrypted before they’re written.
A successful connect flips the WooCommerce card to Connected. Re-running connect with a new key pair replaces the stored one — use it to rotate keys.

​
5. What gets ingested after connect

  • Customers → upserted into your Orbit contact list (email, phone, name) on the scheduled sync, so segments and campaigns can address them.
  • Orders → normalized event records. Order created / updated events are ingested into the CDP event stream as woocommerce.order, which is what flows and audiences trigger on.
  • Products → kept current for catalog-level personalization in messages.
The sync runs on Orbit’s schedule — no webhooks to configure in WooCommerce, no plugins to install.

​
6. Using the events: flows on SMS/WhatsApp

Every ingested order event is a flow trigger you can wire in Flows:
  • Post-purchase — trigger on woocommerce.order (created / updated), wait a fixed window, then send a thank-you or review request on SMS or WhatsApp. Because customer sync and order events share the same contact record, the message addresses the right person.
  • Abandoned cart — trigger on the cart/checkout event, delay to give the buyer a chance to finish, check the order hasn’t closed, then send the recovery link over SMS or WhatsApp.
For the trigger, condition, and channel-node shapes see Flows recipes — substitute the WooCommerce event as the trigger. To rename or reshape event properties per destination (e.g. a downstream webhook subscription), use Event field mappings — note the in-dashboard mappings page currently redirects to the Integrations hub, and the capability runs at the API level today.

​
7. Health monitoring

  • The WooCommerce card badge in the Integrations catalog shows Connected (or Errored if the stored credential stops validating).
  • Open the card’s drawer to inspect sync health — last sync time and any error the scheduled sync surfaced.
  • If the card shows Errored, the usual cause is a rotated or revoked key in WordPress. Upload a fresh pair via Connect with Paste API key; re-running connect replaces the stored credential and clears the error state.

​
8. Test and rollback

Test before building flows — the cleanest end-to-end check is a dry-run checkout:
  1. Add a product to cart on your store and abandon it at checkout (or place a low-value test order).
  2. Watch the contact and event records land in Orbit — the cart/order event should appear on the synced customer.
  3. Build your flow trigger against that verified event.
Rollback — to disconnect:
  1. In the Integrations catalog, open the WooCommerce card and use Revoke (the disconnect action on the card/drawer).
  2. This deletes the stored credential from Orbit, flips the card back to Available, and stops syncs.
  3. Revoke does not touch WordPress. The consumer key you generated still exists in WP admin and is still valid for anything else using it — delete it yourself under WooCommerce → Settings → Advanced → REST API if you want it fully revoked.

​
9. Limits and error taxonomy

Quirks specific to the REST-key integration:
  • HTTPS required — http:// store URLs are rejected at connect; the consumer secret never travels unencrypted.
  • Woo ≥ 3.6 — the probe hits the v3 API namespace; older Woo versions won’t answer.
  • Pretty permalinks required — Plain permalinks make /wp-json/wc/v3/* return 404; connect fails.
  • Public reachability — store URLs that resolve to private/internal addresses (loopback, RFC-1918, cloud metadata endpoints) are rejected for safety, so a VPC-internal staging store can’t be connected directly.
  • Read/Write permission — a Read-only key connects but limits what future features can do; generate new keys with Read/Write.
Connect error codes and what they mean:

​
10. If you’re coming from the Shopify guide

Shopify connects with OAuth (consent redirect, automatic webhook registration) — the dashboard-driven alternative for managed stores. Pick WooCommerce’s key-pair flow when the store is self-hosted WordPress and you want full control over the credential’s lifecycle in WP admin. Both ingest into the same contact + event model, so the flow patterns transfer between them — see Connect Shopify for the OAuth side.