Metorik Docs
Store Connection Errors

WooCommerce rejected the API key

What this error means

Metorik reached your store and WooCommerce replied, but it wouldn't accept the API key we sent. Either the key never reached WooCommerce, WooCommerce has no record of it, or it belongs to a WordPress user who isn't allowed to view orders. Behind the scenes, WooCommerce usually returns a 401 or 403 error saying "Sorry, you cannot list resources." (sometimes in your site's language).

Which message did you see?

Metorik shows one of three messages. The fixes are different, so each one has its own section below with the same title:

  • Your store didn't receive the access you approved: our request reached your store without the key.

  • Your WordPress user can't view store data: WooCommerce accepted the key, but the user who approved it isn't allowed to see orders or products.

  • Your store no longer has the access you approved: the key arrived, but WooCommerce has no record of it.

Clicking Retry in Metorik takes you back to the start, so you'll enter your store address again and approve a fresh API key each time.

Your store didn't receive the access you approved

WooCommerce answered, but our request arrived without the API key, so it couldn't tell who was asking (a 401 error). Work through these checks in order, and click Retry after each one.

Check your store's address doesn't redirect

This is the most common cause. If the address you entered redirects somewhere else, the API key is dropped on the way, because it's only sent to the exact address you entered.

  1. Open a private or incognito browser window and type in the store address exactly as you entered it in Metorik.

  2. Once the page loads, click the address bar to see the full address. If it changed, for example from example.com to www.example.com, from http:// to https://, or to a different domain, that's the problem.

  3. In WordPress, go to Settings → General and copy the Site Address (URL) (WordPress guide).

  4. In Metorik, click Retry, enter that exact address (including https://, and www. if it has it) and approve the connection.

  5. If your store was connected before and you've since changed domains, switched between www and non-www, or moved to https, follow our Store URL or domain changed guide to update the address in Metorik, then reconnect.

Make sure login details aren't being stripped

Some servers strip the login details (the "Authorization header") from requests, so WooCommerce thinks no key was sent.

  1. In WordPress, go to Settings → Permalinks and click Save Changes without changing anything.

  2. On Apache servers, this refreshes your .htaccess file, which includes a line that passes login details through (WordPress reference).

  3. If that doesn't help, add these lines to the very top of the .htaccess file in your site's main folder, above # BEGIN WordPress:

    <IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>

  4. On Nginx, or if you'd rather not edit files, ask your host to "pass the Authorization header through to PHP".

Make sure WordPress knows your site uses HTTPS

WooCommerce only accepts a plain API key over HTTPS. If your site sits behind Cloudflare's Flexible SSL mode or another proxy, WordPress can think requests arrived over plain HTTP and ignore the key.

  1. Check that your store loads at an https:// address with no browser warnings.

  2. If you use Cloudflare, go to SSL/TLS → Overview and choose Full (strict) or Full instead of Flexible (Cloudflare guide).

  3. If your site sits behind a proxy or load balancer, ask your host to make sure WordPress detects HTTPS (WordPress HTTPS guide).

Your WordPress user can't view store data

WooCommerce accepted the API key, but the WordPress user who approved it isn't allowed to view orders or products (a 403 error). The API key has the same permissions as that user.

Reconnect as an Administrator

Connecting again creates a fresh key, which fixes most cases.

  1. Log in to your WordPress dashboard with an account that has the Administrator role.

  2. In Metorik, click Retry, enter your store address again and follow the prompts.

  3. If your store was connected before, go to Settings → Connection & Tools in Metorik (app.metorik.com/settings/stores/current/connection) and click Reconnect store.

  4. On the WooCommerce approval screen, check that the Logged in as name is your Administrator account.

  5. If it shows someone else, click Logout, log in as an Administrator, and start again.

  6. Click Approve and wait a few seconds while Metorik tests the connection.

Check the key's user and permission

  1. In WordPress, go to WooCommerce → Settings → Advanced → REST API.

  2. Look for a key whose Description starts with "Metorik - API".

  3. Check that its Permissions column says Read/Write or Read.

  4. Check that the User column shows an Administrator or Shop Manager.

  5. To check a user's role, go to Users → All Users and look at their Role (WooCommerce roles explained). If it isn't Administrator or Shop Manager, change the Role and click Update User, or reconnect as a different Administrator.

Check role editor and security plugins

If the user is already an Administrator, a role editor plugin may have removed their access to WooCommerce data, or a security or performance plugin may be limiting the WordPress REST API, which Metorik relies on.

  1. Temporarily deactivate your role editor and security plugins and try connecting again.

  2. If that works, reactivate them and adjust the matching setting below.

  3. WP Cerber: on the Hardening tab, if Block access to WordPress REST API except any of the following is on, add wc to the allowed namespaces (WP Cerber guide).

  4. All-In-One Security (AIOS): under AIOS → Firewall → PHP rules → WP REST API, turn off Disallow unauthorized REST requests or whitelist the wc route.

  5. Perfmatters: under General, if Disable REST API is set to Disable for Non-Admins, connect with an Administrator account (Perfmatters guide).

  6. "Disable REST API" plugins: deactivate them or allow WooCommerce.

  7. In any firewall, whitelist Metorik's IPs (23.239.31.174, 45.33.123.9, 45.33.116.36, 96.126.113.196, 173.255.205.248) and the paths wp-json/* and wc-api/*.

Your store no longer has the access you approved

The key reached your store, but WooCommerce has no record of it, usually because it was revoked or deleted.

  1. In Metorik, click Retry, enter your store address again and approve the connection. This creates a new key.

  2. If your store was connected before, go to Settings → Connection & Tools in Metorik and click Reconnect store instead.

  3. After you approve, go to WooCommerce → Settings → Advanced → REST API in WordPress and check that a key whose Description starts with "Metorik - API" appears.

  4. If there's no Metorik key, or it disappears again, a security plugin may be removing API keys. Temporarily deactivate your security plugins and connect again.

If none of this helped

WooCommerce's REST API needs "pretty" permalinks (WooCommerce requirements).

  1. In WordPress, go to Settings → Permalinks.

  2. If Plain is selected, choose another option such as Post name and click Save Changes (check with your developer first, as this changes your page addresses).

Verify it worked

  1. When reconnecting, Metorik confirms the connection works and moves to the next step.

  2. For a store that's already set up, click Check Connection under Settings → Connection & Tools and look for "Everything looks good with your store's API connection."

  3. In WordPress, the Metorik key under WooCommerce → Settings → Advanced → REST API should show a recent date in the Last access column.

Still stuck?

Chat with us from inside Metorik (or click Get help on the error screen) and let us know:

  • Which of the three messages you saw.

  • Who hosts your store.

  • Which security, firewall, or performance plugins you use, and whether you use Cloudflare.

  • Whether your store's address starts with https://, and the exact address you entered.

  • Which steps from this guide you've already tried.

Further reading

Was this helpful?
Was this helpful?