WooCommerce REST API 401 Unauthorized Error: 7 Causes and Fixes

On this page

1. Read the error code first
2. How to fix a WooCommerce REST API 401
3. Edge cases most guides skip
4. FAQs

The WooCommerce REST API returns a 401 Unauthorized error because WordPress didn't receive valid credentials: the server stripped the Authorization header, the request used plain HTTP, the keys are wrong or revoked, or the key belongs to a user without permission.

The error usually comes with a code such as woocommerce_rest_cannot_view ("Sorry, you cannot list resources"), woocommerce_rest_authentication_error or woocommerce_rest_cannot_create. The code tells you whether WooCommerce saw your keys at all.

Read the error code first

• woocommerce_rest_cannot_view or cannot_create: WooCommerce treated the request as coming from nobody, or from a user who can't do that. Most often the keys never arrived.
• woocommerce_rest_authentication_error with "Consumer key is invalid": the keys arrived but don't match. Check for typos or revoked keys.
• "Invalid signature": you are on plain HTTP using OAuth 1.0a, and the signature was built for a different URL than the one the server sees.

How to fix a WooCommerce REST API 401

1. Use HTTPS. Over HTTPS, WooCommerce accepts the consumer key and secret through HTTP Basic Auth. Over plain HTTP it expects OAuth 1.0a signatures instead, so a Basic Auth request on http:// fails. Make sure the site has SSL and that your request URL starts with https://.
2. Pass the Authorization header through to PHP. Many Apache and some CGI/FastCGI setups drop the Authorization header before PHP sees it. Add this near the top of .htaccess, above the WordPress block:

   RewriteEngine On
   RewriteCond %{HTTP:Authorization} ^(.*)
   RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]

   Some hosts need SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 instead. On Nginx, ask the host to pass the header to PHP-FPM.
3. Test with query-string credentials. As a diagnosis, call https://yourdomain.com/wp-json/wc/v3/products?consumer_key=ck_...&consumer_secret=cs_.... If this works and the header doesn't, the server is stripping the header (fix 2). Keep query-string keys to HTTPS only, because they end up in server logs.
4. Check the key's permissions. Go to WooCommerce > Settings > Advanced > REST API. A Read key gets 401 on POST, PUT or DELETE. Generate a Read/Write key if your app creates or updates orders or products.
5. Check the key's user. Each key is tied to a WordPress user. If that user was deleted, demoted from Administrator or Shop Manager, or had capabilities removed by a role plugin, the key stops working. Create a fresh key for an active admin or shop manager.
6. Avoid redirects. If the request goes to http:// or the non-www address and gets a 301 to the real URL, many HTTP clients follow the redirect but drop the Authorization header, so the second request arrives with no credentials. Call the exact final URL, including https:// and the right www or non-www form, so there is no redirect.
7. Check permalinks and security plugins. With Plain permalinks, /wp-json/ doesn't exist; use ?rest_route=/wc/v3/products or switch permalinks to Post name in Settings > Permalinks. Security plugins that "disable REST API for non-logged-in users" also block key-based requests; allow the wc/ namespace.

Edge cases most guides skip

• Old /wc-api/ URLs. The Legacy REST API (/wc-api/v3/) was removed from WooCommerce core in version 9.0 and now needs a separate plugin. Old integrations calling it fail. Move them to /wp-json/wc/v3/.
• Cloudflare or a host firewall. A WAF rule can block requests from a server IP or strip headers. If the 401 or 403 page looks like Cloudflare's, check the firewall events.
• Keys with spaces. Copying keys from email or a PDF can add a space or line break. Paste them into a plain text editor first.
• Staging and live keys. Keys are stored in the database. Keys made on staging don't exist on live unless the database was copied, and a database copy brings staging keys to live.

For how the REST API fits into WordPress generally, see the WordPress REST API explained. If an ERP, courier, marketplace or app integration still won't connect, our WooCommerce developer service can debug the request end to end.

FAQs

Where do I create WooCommerce API keys?

Go to WooCommerce > Settings > Advanced > REST API and click Add key. The secret is shown only once, so copy it straight away.

Why does the API work in Postman but not in my app?

Usually your app hits a redirect and drops the header, uses http://, or uses a Read key for a write request.

What's the difference between 401 and 403 here?

401 means WooCommerce didn't accept who you are. 403 often comes from a firewall or a user who is known but not allowed.