Why Isn't the WooCommerce REST API Responding Correctly?

Why This Happens

WordPress's REST API (which WooCommerce's own API builds on) relies on proper URL rewriting to route requests correctly, which requires a permalink structure other than the default "Plain" setting. Beyond that, WooCommerce's API keys carry specific, explicitly granted permissions, and various security tools (firewalls, security plugins) sometimes block REST API traffic by default as a blanket security measure, unaware that legitimate integrations depend on it.

Common Causes

• Permalink structure set to "Plain" under Settings → Permalinks, which breaks REST API routing entirely regardless of anything else being configured correctly.
• API key permissions insufficient for the specific operation being attempted — a read-only key can't be used for a write/update request, which will fail with an authorization error rather than a generic one.
• A security plugin or web application firewall blocking REST API endpoints, sometimes as an overly broad default rule not intended to catch legitimate WooCommerce API use.
• Expired or revoked API keys, particularly if keys were regenerated at some point without updating the integration using the old ones.
• A caching layer incorrectly caching API responses that should be dynamic, causing stale or unexpected data to be returned.

How to Diagnose and Fix It

1. Confirm permalinks aren't set to "Plain" first, since this alone can explain a complete API failure.
2. Check the specific API key's permissions against what the failing request actually needs.
3. Test the API request directly (via a tool like Postman) outside of the integrating application, to isolate whether the issue is server-side or specific to the integration's own code.
4. Temporarily disable security plugins on staging to test whether one is blocking REST API traffic.

Testing the API step by step

1. Load the base address. Open /wp-json/ in a browser. It should return a JSON list of routes. If pretty permalinks aren't working, /?rest_route=/ still reaches the API, which helps tell a routing problem from a WooCommerce one.
2. Try an authenticated request. With a consumer key and secret, request a simple endpoint such as /wp-json/wc/v3/products over HTTPS. Basic authentication with those keys only works over HTTPS; plain HTTP needs OAuth 1.0a.
3. Read the status code. A 401 points to bad credentials or a stripped Authorization header. A 403 points to insufficient permissions or a firewall. A 404 points to routing or the wrong endpoint, and a 500 points to a PHP error.
4. Check the Authorization header. Some hosts drop it before WordPress sees it. The standard WordPress .htaccess block includes a line to pass it through, so a customised or replaced file can break authentication.
5. Read the security plugin's block log for rejected API requests.

Need a broken API integration diagnosed and fixed? See custom WooCommerce development.