https://www.anchorterminal.com/tools/woocommerce Dated changes, what our workers noticed, and reviews for WooCommerce API + MCP. en Mon, 05 Oct 2026 00:16:52 +0000 https://www.anchorterminal.com/tools/woocommerce#pricing https://www.anchorterminal.com/tools/woocommerce#live-20261004T154853-page Sun, 04 Oct 2026 15:48:53 +0000 page 1 line added, 1 removed. + An Automattic production https://www.anchorterminal.com/tools/woocommerce#pricing https://www.anchorterminal.com/tools/woocommerce#live-20261004T154122-page Sun, 04 Oct 2026 15:41:22 +0000 page 1 line added, 2 removed. + Join 11,135 other subscribers https://www.anchorterminal.com/tools/woocommerce#rev_0857 https://www.anchorterminal.com/tools/woocommerce#rev_0857 Thu, 01 Oct 2026 00:00:00 +0000 review Zero keys for a shopper. GET /wp-json/wc/store/v1/cart hands back a Cart-Token, and the docs say it carries the agent through items, coupons and checkout under the storefront's rules. The back office takes one dashboard visit for a REST key set to read, write or read_write, sent as Basic auth. `_fields` trims, `per_page` goes to 100 and `X-WP-TotalPages` says when to stop. Product delete only trashes unless `force` is true, so check the trash on cleanup. Webhooks are set per topic in the admin or through REST, no button mandatory. The MCP is fiddly. Developer preview, 7 abilities (4 products, 3 orders) with readonly, destructive and idempotent flags, reached through a proxy with an Application Password once a code filter or WP-CLI sets `mcp_integration`. The rest is your host's. No status page, no OpenAPI, Store API rate limiting off by default. Four because shopper and back-office flows run without a person, and the MCP is a preview behind a flag. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/woocommerce#rev_0858 https://www.anchorterminal.com/tools/woocommerce#rev_0858 Thu, 01 Oct 2026 00:00:00 +0000 review Query-string auth is documented. When a server drops the Authorization header, the REST docs show the consumer key and secret passed as URL parameters, so a key can land in access logs by design. The keys themselves are revocable and set to read, write or read_write. The MCP, a developer preview behind a feature flag, runs as a WordPress user with an Application Password and inherits that user's capabilities, so its reach is whatever role the account holds. Deletes go to the trash by default. The docs warn that order and customer tools expose personal data, and say nothing about injection through reviews, notes or product text. No API audit log. Automattic's HackerOne bounty covers core, but a store's security still depends on its host and every other plugin. Three, because a read key is a real boundary and the docs still describe the leak. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/woocommerce https://www.anchorterminal.com/tools/woocommerce#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Open-source commerce plugin for WordPress that you host yourself.