WooCommerce / Integrations
WooCommerce REST API Troubleshooting
Short answer
Read the HTTP status and the code field in the JSON response. A 401 with woocommerce_rest_cannot_view or an authentication error means the request was not authenticated or the key lacks permission. A 404 rest_no_route means the URL or API version is wrong, or the REST API is not reachable at /wp-json/. A 403 without a WooCommerce error code usually comes from a security plugin, WAF or host. A 500 is a PHP error on the store. Test the same call with curl to separate the client from the store.
Symptoms
- An integration (ERP, CRM, mobile app, marketplace connector) receives 401, 403, 404 or 500 responses.
- It worked before a hosting change, an HTTPS migration, a security plugin update or a permalink change.
- Some endpoints work and others fail.
- Requests are slow or time out on large collections.
- Data returned by the API is outdated.
Most common causes
| Response | Typical cause |
|---|---|
401 woocommerce_rest_cannot_view |
Not authenticated, or the key's user/permission cannot read the resource |
401 woocommerce_rest_authentication_error |
Invalid consumer key, invalid signature (OAuth over HTTP), or a wrong timestamp |
401 with valid keys that work elsewhere |
The server strips the Authorization header before PHP sees it |
403 without a WooCommerce code |
Security plugin, WAF, ModSecurity or host blocking the request |
404 rest_no_route |
Wrong path, version or method; REST API not reachable at /wp-json/ |
500 |
PHP fatal error while building the response |
| Timeouts | Very large per_page, heavy extensions adding data, slow queries |
Diagnosis
1. Reproduce with curl
Take the client out of the equation. With a read-only key on a staging copy if possible:
$ curl -s -i -u ck_your_key:cs_your_secret "https://example.com/wp-json/wc/v3/orders?per_page=1"If curl works and the integration doesn't, the problem is in the client: URL, method, headers or how it sends the keys. If curl fails the same way, the problem is on the store's side.
2. Read the status and the error code
The JSON body contains a code and a message. A WooCommerce or WordPress code (woocommerce_rest_…, rest_…) means the request reached WordPress. A 403 or HTML error page without such a code means something in front of WordPress answered.
3. Check the key
Under WooCommerce → Settings → Advanced → REST API: does the key exist, does it have the right permission (Read, Write or Read/Write), which user does it belong to, and when was it last used? A key whose user was deleted or lost its role will fail.
4. Check that the Authorization header reaches PHP
On some Apache + CGI/FastCGI setups, the Authorization header is not passed to PHP, so Basic authentication silently fails. The .htaccess rule WordPress normally includes passes it through:
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]5. Check what sits in front of WordPress
Security plugins, the host's WAF, ModSecurity and CDNs can block /wp-json/ requests, specific methods (PUT, DELETE) or unknown user agents. Their logs show blocked requests with the reason.
Logs and technical checks
- The full HTTP response: status, headers and body.
- WooCommerce REST API keys: permission, user, last access.
- WooCommerce → Status → Logs (
fatal-errors) and the PHP error log for 500 responses. - Security plugin, WAF and CDN logs for 403 responses.
- Settings → Permalinks: plain permalinks disable pretty
/wp-json/URLs. - Cache rules:
/wp-json/must not be cached for authenticated requests.
Solutions
- Use HTTPS with Basic authentication, keys with the minimum permission needed, and one key per integration so they can be revoked independently.
- Pass the Authorization header to PHP where the server strips it.
- Allow the API in security layers for the specific routes and methods the integration needs, rather than disabling protection.
- Use the correct route and version (
/wp-json/wc/v3/…), and?rest_route=only where pretty permalinks are not available. - Paginate sensibly: moderate
per_pagevalues, and fields filtering where the client supports it. - Fix PHP errors behind 500 responses; they are often caused by extensions adding data to API responses.
- Exclude
/wp-json/from page and CDN caching for authenticated requests.
What not to do
- Do not give integrations administrator keys with read/write access when read access is enough.
- Do not put keys in client-side JavaScript or share one key between systems.
- Do not disable the security plugin entirely to make one integration work.
- Do not raise
per_pageto the maximum to "make it faster"; large responses are slower and time out more often.
When to contact an expert
Bring in an engineer when the integration moves orders, stock or payments and failures cause data inconsistencies, when the problem sits between hosting, security layers and the client, or when the integration needs to be redesigned with retries, logging and webhooks.
Related problems
- WooCommerce / Integrations WooCommerce Webhook Troubleshooting Delivery logs, response codes, signatures, and why WooCommerce disables a webhook after repeated failed deliveries.
- WooCommerce / Errors WooCommerce Fatal Error: A Practical Troubleshooting Guide Read the fatal error properly — file, line, stack trace — and connect it to the change that triggered it.
- WooCommerce / Performance WooCommerce Action Scheduler Problems Past-due, failed and stuck scheduled actions: how the queue runs, why it stalls and how to fix it without losing pending work.
Frequently asked questions
Why does the WooCommerce REST API return 401 woocommerce_rest_cannot_view?
The request was not authenticated as a user allowed to read that resource. Check the keys, their read/write permission, the user they belong to, and whether the Authorization header reaches PHP.
What does rest_no_route mean?
No REST route matches the URL and method. Check the API version in the path (such as /wp-json/wc/v3/), the HTTP method, and that the REST API is reachable — with plain permalinks, /wp-json/ does not work and ?rest_route= must be used.
Should I send API keys in the query string?
Use HTTP Basic authentication over HTTPS where possible. Keys in query strings end up in server logs, proxies and analytics. The query-string method exists for servers that strip the Authorization header.
Why do API responses look outdated?
A cache layer — a CDN or page cache — may be caching /wp-json/ responses. API responses for authenticated requests should never be cached.