Connect WooCommerce with REST keys and automatic webhooks
Connect a WooCommerce store without a plugin using REST keys: steps, webhook signature verification, order-to-parcel rules, status sent back, and common errors.
Last updated 22 October 2026 · Last verified 22 October 2026
Purpose#
This method connects a WooCommerce store to the platform with no plugin: you create REST keys in your store and paste them into the WooCommerce card, and the platform registers the webhooks automatically. After that every eligible new order (see the table below) becomes a parcel while the connection is active and "Automatically create a parcel for each order" is on (the default), and the shipment status goes back to the order in your store.
Who can use it and what you need#
- A platform merchant whose plan includes Store integrations and who has room under "Number of connected stores". A merchant created by a delivery company cannot open the page.
- A store on HTTPS at a public address (internal addresses are refused), with WordPress permalinks not set to Plain.
- An admin account in WordPress to create the keys.
- A delivery company available to you and an active pickup location, both mandatory.
Connection steps#
Create the REST key in WordPress
In the WordPress dashboard: WooCommerce → Settings → Advanced → REST API → Add key. Set the description to Delivery Syria, the user to an admin account, the permissions to Read/Write, then Generate API key.
Copy the two keys
Copy the Consumer key (starts with
ck_) and the Consumer secret (starts withcs_).Fill in the WooCommerce card
In Store integrations paste the store URL (such as
https://mystore.com) and the two keys, choose the shipping company and the pickup location for this store's orders, then press Connect WooCommerce. The platform checks the keys by reading one order, saves the connection and adds theorder.createdandorder.updatedwebhooks.Check the result
On success you see "Store connected" followed by your store name, then "Webhooks registered in the store (new order + order update).". If webhook registration fails the connection remains, a warning appears ("Store connected, but: …") and the reason is shown under the store.
Try an order
Create a test order in your store. If it does not arrive within minutes, press Test connection, then Fetch latest orders.
- See this store's orders
- Delivery company for the store's orders
- Default pickup place
Expected result#
The store appears under "Your connected stores" with the WooCommerce label and the store name. Orders are handled like this:
| Order in WooCommerce | Result |
|---|---|
Cash on delivery (cod) |
A parcel with the order total to collect |
Paid online (date_paid present, or status processing) |
A parcel with no collection |
| Not paid | Waits for payment |
cancelled, refunded, failed or trash |
Marked cancelled |
completed (checked before payment) |
Ignored: no parcel is created automatically, but Retry on the ignored order in the orders log does create one |
The name and address come from the shipping data (otherwise billing), and the governorate is read from the city and state fields; if it is not recognized, choose it manually from the orders log. The parcel weight is the "Default weight" (1 kg unless you change it) because WooCommerce does not send the weight. The parcel carries an invoice number shaped WOOC<connection_id>-<order_number>, that is WOOC, the connection number, a hyphen, then the order number.
After the parcel is created a note with the shipment number is added to the order (visible to the customer), and a note is added at each status change, visible to the customer when the courier is assigned and on delivery. On full or partial delivery the order status becomes completed. This needs "Send shipment status back to the store" to be on.
Webhook and signature verification#
The receiving address /api/stores/woocommerce/<token> is specific to each connection (<token> is a random string unique to it). WooCommerce signs the request in the X-WC-Webhook-Signature header (Base64 of HMAC-SHA256 of the body with the connection secret) and the platform verifies it: an unknown token returns 404 (Unknown store) and a wrong signature returns 401 (Invalid signature). If you must add the webhook manually, the store card has "Webhook details (for manual setup)": the Delivery URL and the Secret, with the events order.created and order.updated. The "Re-register Webhooks" button deletes what was registered for the same URL and creates it again.
Disconnecting#
Suspend stops automatic parcel creation and Delete removes the connection while the parcels remain. The platform does not remove the webhooks from your store, so delete them in the store settings, and revoke the REST key if you no longer need it.
Common mistakes#
| Message | Cause and fix |
|---|---|
| "The store URL must be complete, e.g. https://mystore.com" | Type the full URL |
| "The store must use HTTPS (keys are sent with the request)." | Enable HTTPS on the store |
| "The store URL must be https://domain without a custom port." | Only port 443 or 8443 is accepted, with no user name |
"Consumer Key starts with ck_" or "Consumer Secret starts with cs_" |
Check each key is in its own field |
| "Keys rejected by the store (401)…" | Check both keys and that the permission is Read/Write |
| "REST URL not found…" (404) | Fix the URL and change the permalinks from Plain |
| "Store response: HTTP 301 (redirects to another URL — enter the exact final store URL, with or without www)" | The code may be another 3xx. Type the final URL exactly, with or without www |
| "The store URL points to a disallowed internal address." | The store must be at a public address |
| "This store is connected to another merchant account on the platform." | The store is linked to another account |
Security#
- Redirects are not followed, only public addresses are accepted, and the keys travel with the request, so HTTPS is required.
- The REST keys and the webhook secret are stored encrypted, and each connection has its own random token and secret.
Limits and permissions#
- New connections are limited to 20 requests per minute, and receiving to 240 requests per minute.
- "Fetch latest orders" retrieves the last 20 orders.
- A background job every 5 minutes processes late orders for up to 7 days.
- Some messages appear in Arabic only, even in the English interface.
API
POST /api/stores/woocommerce/{token}