> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect WooCommerce: REST key pair, order events, and cart recovery

> Operator walkthrough for the WooCommerce integration: generate a consumer key pair in WordPress admin, connect with the Paste API key flow (no OAuth), ingest customer/order/product sync and cart events, and trigger post-purchase flows on SMS/WhatsApp.

# Connect WooCommerce end to end

WooCommerce is the self-hosted WordPress e-commerce option in the Integrations catalog. Unlike the OAuth-backed entries (Shopify, HubSpot), WooCommerce connects with a **REST API key pair** — you generate a consumer key and consumer secret in WordPress admin and paste them into a dialog. No consent screen, no redirect.

This guide walks the whole flow: generating the key pair, connecting, understanding what syncs, building messaging flows off the events, and revoking cleanly when you're done.

<Note>
  The connect step is **owner/admin only** — it's the only step that touches store credentials. Everything after connect (syncs, event ingest) is automatic.
</Note>

## 1. Where to find it

Open **Settings → Integrations**. In the discovery sidebar pick **Ecommerce** — the WooCommerce card sits alongside Shopify. The card's CTA reads **Paste API key**, not "Connect," because there is no OAuth consent step for this integration.

## 2. What does it do?

Once connected, Orbit syncs your WooCommerce **customers, orders, and products** on a scheduled poll and ingests them into your contact list and CDP event stream. Two messaging patterns become available immediately:

* **Post-purchase flows** — order created / updated events land as `woocommerce.order` events you can trigger on (thank-you, review request, fulfillment follow-up) over SMS or WhatsApp.
* **Abandoned-cart recovery** — checkout/cart events let you fire a drip with a recovery link, over SMS or WhatsApp.

## 3. Generate the consumer key pair in WordPress

Do this first, in the WordPress admin of the store you want to connect:

1. In WordPress admin, go to **WooCommerce → Settings → Advanced → REST API**.
2. Click **Add key**.
3. Give the key a description (e.g. "Orbit"), pick the WP user it will run as, and set **Permissions to Read/Write**.
4. Click **Generate API key**. WordPress shows the **Consumer key** (starts with `ck_`) and **Consumer secret** (starts with `cs_`) — shown exactly once. Copy both before leaving the page.

**Store readiness checklist** — the v3 REST API needs all of these:

* WooCommerce **3.6 or newer** (the v3 API namespace the integration probes).
* **Permalinks set to a "pretty" mode** (Settings → Permalinks — anything except **Plain**). With Plain permalinks the REST endpoints return 404.
* **HTTPS on the storefront.** The consumer secret never travels over plain HTTP; connect rejects `http://` URLs.
* The REST API must be reachable over the public internet (no maintenance-mode plugin or IP allow-list blocking `/wp-json/`).

## 4. Connect with Paste API key

1. In **Settings → Integrations**, click **Paste API key** on the WooCommerce card.
2. The connect dialog asks for three values:
   * **Store URL** — the full storefront origin, e.g. `https://store.example.com`. Must be HTTPS.
   * **Consumer key** — the `ck_` value from Step 3.
   * **Consumer secret** — the `cs_` value from Step 3 (entered into a masked password field).
3. Expand **Where do I find these?** inside the dialog if you need the WP admin path again — it restates the exact WooCommerce → Settings → Advanced → REST API steps.
4. Click **Connect**. Orbit validates the pair against your store by calling `GET /wp-json/wc/v3/orders?per_page=1`, and only stores the key pair when that probe returns success. Both halves are encrypted before they're written.

<Check>
  A successful connect flips the WooCommerce card to **Connected**. Re-running connect with a new key pair replaces the stored one — use it to rotate keys.
</Check>

## 5. What gets ingested after connect

* **Customers** → upserted into your Orbit contact list (email, phone, name) on the scheduled sync, so segments and campaigns can address them.
* **Orders** → normalized event records. Order created / updated events are ingested into the CDP event stream as `woocommerce.order`, which is what flows and audiences trigger on.
* **Products** → kept current for catalog-level personalization in messages.

The sync runs on Orbit's schedule — no webhooks to configure in WooCommerce, no plugins to install.

## 6. Using the events: flows on SMS/WhatsApp

Every ingested order event is a flow trigger you can wire in **Flows**:

* **Post-purchase** — trigger on `woocommerce.order` (created / updated), wait a fixed window, then send a thank-you or review request on SMS or WhatsApp. Because customer sync and order events share the same contact record, the message addresses the right person.
* **Abandoned cart** — trigger on the cart/checkout event, delay to give the buyer a chance to finish, check the order hasn't closed, then send the recovery link over SMS or WhatsApp.

For the trigger, condition, and channel-node shapes see [Flows recipes](/guides/flows-recipes) — substitute the WooCommerce event as the trigger. To rename or reshape event properties per destination (e.g. a downstream webhook subscription), use [Event field mappings](/guides/integrations-event-field-mappings) — note the in-dashboard mappings page currently redirects to the Integrations hub, and the capability runs at the API level today.

## 7. Health monitoring

* The WooCommerce **card badge** in the Integrations catalog shows **Connected** (or **Errored** if the stored credential stops validating).
* Open the card's **drawer** to inspect sync health — last sync time and any error the scheduled sync surfaced.
* If the card shows **Errored**, the usual cause is a rotated or revoked key in WordPress. Upload a fresh pair via [Connect with Paste API key](#4-connect-with-paste-api-key); re-running connect replaces the stored credential and clears the error state.

## 8. Test and rollback

**Test before building flows** — the cleanest end-to-end check is a dry-run checkout:

1. Add a product to cart on your store and abandon it at checkout (or place a low-value test order).
2. Watch the contact and event records land in Orbit — the cart/order event should appear on the synced customer.
3. Build your flow trigger against that verified event.

**Rollback** — to disconnect:

1. In the Integrations catalog, open the WooCommerce card and use **Revoke** (the disconnect action on the card/drawer).
2. This deletes the stored credential from Orbit, flips the card back to **Available**, and stops syncs.
3. **Revoke does not touch WordPress.** The consumer key you generated still exists in WP admin and is still valid for anything else using it — delete it yourself under **WooCommerce → Settings → Advanced → REST API** if you want it fully revoked.

## 9. Limits and error taxonomy

Quirks specific to the REST-key integration:

* **HTTPS required** — `http://` store URLs are rejected at connect; the consumer secret never travels unencrypted.
* **Woo ≥ 3.6** — the probe hits the v3 API namespace; older Woo versions won't answer.
* **Pretty permalinks required** — Plain permalinks make `/wp-json/wc/v3/*` return 404; connect fails.
* **Public reachability** — store URLs that resolve to private/internal addresses (loopback, RFC-1918, cloud metadata endpoints) are rejected for safety, so a VPC-internal staging store can't be connected directly.
* **Read/Write permission** — a Read-only key connects but limits what future features can do; generate new keys with Read/Write.

Connect error codes and what they mean:

| Error code                               | Cause                                                 | Fix                                                                                              |
| ---------------------------------------- | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| `WOO_INVALID_URL` / `WOO_HTTPS_REQUIRED` | Malformed URL or plain HTTP                           | Re-enter the full `https://` storefront URL                                                      |
| `WOO_UNREACHABLE`                        | Network/timeout reaching the store                    | Confirm the site is up and the REST API is enabled; check for maintenance-mode or IP allow-lists |
| `WOO_AUTH_FAILED`                        | WP rejected the key pair                              | Regenerate the key in WooCommerce → Settings → Advanced → REST API and confirm Read/Write        |
| `WOO_REST_NOT_FOUND`                     | 404 from the v3 endpoint                              | WooCommerce not installed/activated, or permalinks set to Plain                                  |
| `WOO_VALIDATION_FAILED`                  | Store returned a non-2xx status                       | Check the store URL and key permissions                                                          |
| `WOO_INVALID_STORE_URL`                  | URL points to a private/internal/host-blocked address | Use the publicly reachable store address                                                         |

## 10. If you're coming from the Shopify guide

Shopify connects with OAuth (consent redirect, automatic webhook registration) — the dashboard-driven alternative for managed stores. Pick WooCommerce's key-pair flow when the store is self-hosted WordPress and you want full control over the credential's lifecycle in WP admin. Both ingest into the same contact + event model, so the flow patterns transfer between them — see [Connect Shopify](/guides/shopify-integration) for the OAuth side.

## Related reading

* [Connect Shopify](/guides/shopify-integration) — the OAuth alternative for managed stores.
* [Flows recipes](/guides/flows-recipes) — trigger/condition shapes for cart-recovery and post-purchase drips.
* [Event field mappings](/guides/integrations-event-field-mappings) — reshape event properties per downstream destination.