BusyBot

Reference · Credentials

WooCommerce API credentials

Used by 2 BusyBot nodes.

Type woocommerceApi 4 fields

The WooCommerce credential holds a consumer key and secret generated inside your WordPress admin, plus your store URL. It also carries a fallback switch for servers that strip the Authorization header — a common shared-hosting problem that makes a perfectly valid key look invalid.

Fields

FieldTypeRequiredNotes
Consumer Key
consumerKey		 password Yes Your WooCommerce REST API consumer key
Consumer Secret
consumerSecret		 password Yes Your WooCommerce REST API consumer secret
WooCommerce URL
url		 string Yes The base URL of your WooCommerce store
Include Credentials in Query
includeCredentialsInQuery		 string No Set to "true" if your server does not parse the Authorization header correctly.

Getting your credentials

  1. Sign in to your WordPress admin.
  2. Go to WooCommerce → Settings → Advanced → REST API and add a key.
  3. Choose the WordPress user it acts as, describe it, and set permissions to Read, Write or Read/Write — grant the least the workflow needs.
  4. Generate the key and copy both the Consumer Key (ck_…) and Consumer Secret (cs_…) immediately. They are shown once.
  5. Set URL to your store’s base URL, including https://.
  6. If authentication fails on a server that strips the Authorization header, set Include Credentials In Query to true as a fallback.

Permissions and scopes

The key acts as the WordPress user it was created for, bounded by the Read/Write permission chosen. A read-only key is the right default for reporting workflows.

The REST API requires HTTPS for header-based authentication. Query-parameter credentials are the documented fallback but expose the key in logs, so use them only when the server genuinely mishandles headers.

Troubleshooting

  • 401 despite correct keys — the server is stripping the Authorization header, which is common on shared hosting. Set Include Credentials In Query to true.
  • 404 on every endpoint — the URL is wrong, or WordPress permalinks are set to plain, which breaks REST routes.
  • 403 on a write — the key was issued read-only, or the underlying WordPress user lacks the capability.
  • Store URL redirects — a redirect from http to https or www can drop the auth header. Use the canonical URL directly.

Frequently asked questions

Why do valid keys return 401?

Many shared hosts strip the Authorization header before PHP sees it. Setting Include Credentials In Query to `true` is the documented fallback — use it only when needed, since it puts the key in the URL.

Where are WooCommerce API keys created?

In WordPress admin under WooCommerce → Settings → Advanced → REST API, where you also choose the user and the read/write permission.

Why does every endpoint 404?

Usually the store URL is wrong, or WordPress permalinks are set to plain — REST routes need pretty permalinks enabled.

Does one credential cover the node and the trigger?

Yes, both declare the same credential type.

Nodes that use WooCommerce API

One credential works across every node below — create it once and reuse it.

Last updated . Spotted something wrong? Tell us.