WooCommerce
Connect a WooCommerce store over HTTPS and start workflows from its core webhook events.
Connect your store
- In WordPress, open WooCommerce > Settings > Advanced > REST API and choose Add key.
- Select a user who can manage WooCommerce and set permissions to Read/Write.
- In Helios, choose WooCommerce API keys. Enter your store's HTTPS URL, such as
https://shop.example.com, including any WordPress installation subdirectory. - Enter the Consumer key and Consumer secret shown by WooCommerce.
Helios encrypts both credentials and sends them using HTTP Basic authentication over HTTPS. Plain HTTP stores are rejected. The connection check calls GET /data, which requires read access and permission to manage WooCommerce. It does not prove write access; webhook setup checks that separately.
WooCommerce key permissions are read, write and read_write. Choose read_write for this integration. The user's WordPress capabilities also limit access. Keys have no scheduled refresh; replace revoked keys in the connection. Helios does not implement WooCommerce's optional browser key-provisioning flow, HTTP OAuth 1.0a, WordPress Application Passwords or plugin-specific OAuth providers. See the official authentication guide.
API access
Agents search the official REST API v3 reference and call your store under /wp-json/wc/v3. This covers orders, refunds, products, variations, customers, coupons, reports, taxes, shipping, payments, settings and other documented v3 resources. Your installed WooCommerce version, extensions and permissions determine which operations succeed.
Enable pretty permalinks in WordPress. If requests return 401, check the key permissions, associated user and whether your web server forwards the Authorization header. Helios does not send credentials in query parameters. Hosting providers and plugins can impose rate limits; WooCommerce does not document one universal REST v3 quota. Collection endpoints support page and up to 100 items per page.
The public Store API and WordPress media API use separate namespaces and authentication and are outside this connection. Product image and download fields accept URLs. Agents use curl for presigned file transfers.
Triggers
Helios automatically creates one webhook per core topic and supplies a signing secret. It updates existing webhooks at this connection's URL, reactivates disabled subscriptions during setup, and removes duplicates after a successful update. Disconnecting removes webhooks at that URL. Reserve the connection URL for Helios.
| Events | Filters |
|---|---|
coupon.created, coupon.updated, coupon.restored | Resource ID, coupon code, discount type, eligible product and category IDs, allowed email |
customer.created, customer.updated | Resource ID, email, role, billing and shipping country |
order.created, order.updated, order.restored | Resource ID, order status, customer ID, billing email, currency, payment method, product and variation IDs, coupon code, shipping country |
product.created, product.updated, product.restored, product.published | Resource ID, SKU, product type, publication status, stock status, category and tag IDs |
coupon.deleted, customer.deleted, order.deleted, product.deleted | Resource ID only |
Filters accept patterns such as *@example.com; email patterns ignore case. Empty filters accept all values. A selected filter cannot match a missing field. Workflows receive { topic, resource }, with the WooCommerce resource in resource. Delete payloads contain only the resource ID.
Custom action.woocommerce_* and action.wc_* topics are excluded because their hook names and arguments are open-ended. Extension-defined topics are also outside the core catalog. Older stores may reject newer topics, including product.published. Rejected topics appear as unavailable with the vendor's reason only when no retained active subscription covers them. A failed update leaves existing subscriptions in place. A failed listing stops setup or teardown.
Delivery behavior
Helios verifies X-WC-Webhook-Signature as base64 HMAC-SHA256 over the raw body. The unsigned form ping sent during creation receives HTTP 200 without starting a workflow. Each event delivery contains one resource, not an array.
WooCommerce does not sign a freshness timestamp. Helios deduplicates using the delivery ID, topic, resource ID and body digest. The digest distinguishes different payloads when WooCommerce reuses a delivery ID within one second. Identical deliveries with the same ID and body remain indistinguishable. Without a delivery ID, identical topic/resource/body combinations share an ID.
Background processing can coalesce updates, and payloads can reflect a later resource state. Repeated delivery failures can disable a webhook; the threshold varies between versions and can be customized. Check WooCommerce > Status > Logs, resolve the delivery error and rerun connection setup to reactivate the subscription. This integration does not promise replay of missed events.
See the webhook reference and the core topic map.
Last updated on