I'm building a native app that will be using the woocommerce API to gather products.

The API user i created has READ only access to the API. The app I'm making will be publicly available, so is there any security concerns with having the api keys exposed?

As the app wouldn't be hard to de-compile and get the API keys.

It is read-only and I didn't see anything concerning in the API for read only users.

Any suggestions and advice is appreciated.

  • How to handle authentication for an API in an app is a separate question from WordPress or WooCommerce entirely. It doesn’t necessarily matter what the key is for when it comes to handling it in the app, so this is a better question for a more general forum like stack overflow, or one focused on the platform you’re developing your app for. Commented Jul 28, 2020 at 14:11
  • @JacobPeattie im already using the key provided by woocommerce and its being authed with basic auth. The question is more pointing at woocommerce.
    – hurnhu
    Commented Jul 28, 2020 at 17:08

1 Answer 1


As you hint at, it sounds like intuitively very bad design to have one key for all users that's hard coded in your app. You can't retract that key without breaking the app for all users, and you can't limit access easily if one user e.g. overloads your API. If you do this, you may as well have no key at all as it's likely trivial to recover the key.

Better design in this case is to issue a key per user and include in your app a requirement for a user to enter their own key before the API will work. (Or if they don't enter a key they are limited somehow to only a small number of accesses)

This means you need to:

  1. Find a way to issue keys per user
  2. Update your app to allow entering the API Key

This should sound familiar as lots of services like any of the Google API's work like this - you have to register, get a key, put the key in your app/code.

  • I could sidestep woocommerce API and just use the builtin WP api /wp-json/wp/v2 that is publicly available on the site currently. The woocommerce API just makes it a lot easier than having to go through the WP api for the same info. So there is already an un limited access API on the site..
    – hurnhu
    Commented Jul 28, 2020 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.