Plugin API Key

View plugin-key metadata or rotate the merchant's WooCommerce plugin API key. Raw keys are shown only when issued, and rotation immediately invalidates the previous key.

Current WooCommerce Plugin Key

The dashboard/API can return key metadata such as its prefix and creation date, but never the stored raw key. The SaaS hashes plugin keys at rest.

Issuance

The one-click WooCommerce connection flow returns only a short-lived code to the browser. The initiating WordPress server must prove its locally retained verifier before the API reveals the store-bound key once; the permanent key must never enter a URL.

Rotation

For an account with one connected WooCommerce store, rotation immediately invalidates that store's previous key and returns the replacement once. Accounts with multiple WooCommerce stores must reconnect from the specific plugin so another store's credential is not revoked.

Do not confuse key models: The current one-click plugin uses the merchant plugin API key. The core Stores API can still issue a WooCommerce public/secret HMAC pair for the legacy manual store flow. Shopify and Wix use OAuth instead.