WooCommerce REST API Request Builder

Pick an endpoint and fill in a form, get curl, JavaScript, PHP, Python and a Postman collection back. Your key never leaves your browser.

Your details

Store URL

No trailing slash needed.

Endpoint

Method

Query parameters, one per line (key=value)

Consumer key

WooCommerce → Settings → Advanced → REST API → Add key.

Consumer secret

Authentication

Basic auth needs HTTPS and is what WooCommerce recommends. Query string also works over plain HTTP.

Output

Your request

curl -X GET \
  -u "ck_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:cs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  "https://example.com/wp-json/wc/v3/orders?per_page=20&status=processing"

This only builds the request text below. Nothing is sent from this page.

Everything above runs in your browser. Nothing you type here, including keys or passwords, is sent to this site or saved in the page's address.

How WooCommerce REST API authentication works

Every request needs a consumer key and secret from WooCommerce → Settings → Advanced → REST API → Add key. Give the key Read permission unless you specifically need to write data, and a descriptive name so you can find and revoke it later.

HTTP Basic auth (recommended): the consumer key as the username, the secret as the password. Works over HTTPS.
Query string: ?consumer_key=...&consumer_secret=... appended to the URL. Works over plain HTTP too, but the key and secret can end up in server access logs.

This tool never sends anything anywhere. It only assembles the request text below from what you type, so you can copy it into your own terminal, script or Postman.

Using the generated request

curl: paste it straight into a terminal.
JavaScript / PHP / Python: paste into a script. The PHP version uses plain cURL functions, no WordPress required, so it also works from an external server.
Postman: download the file and use Postman's Import button to load it as a ready-made request.

Questions people ask

Does this tool call my store's API for me?

No. It only builds the request text. You run the generated curl, script or Postman request yourself, from wherever you want it to run.

Is query-string authentication safe?

It works everywhere, but the key and secret sit in the URL, which can be logged by your server or a proxy. Use HTTP Basic auth over HTTPS whenever the host supports it.

What permission should I give the key?

Read-only for anything that just pulls data (reports, exports, dashboards). Only use Read/Write if you're actually creating or updating orders, products or other resources.

Can I use this against the legacy /wc-api/ endpoints?

No, this targets the current REST API (/wp-json/wc/v3/). For the older endpoints, use the Legacy REST API Migration Mapper.

Last reviewed 30 September 2026.

Sources: WooCommerce REST API Documentation