How a mobile app talks to WooCommerce

By Abdalla Kamesh · Updated September 25, 2026 · Published September 9, 2026 · 5 min read

You do not need to be a developer to run a store with an app in front of it. You do need a working mental model of how the two talk, because when something goes wrong the symptom appears in the app and the cause is almost always in WordPress.

Here is that model, without the code.

WooCommerce is already an API

Every WooCommerce install ships a REST API. It is how the official mobile admin app works, how your accounting integration pulls orders, and how a storefront app reads your catalog. It lives under /wp-json/wc/v3/ on your own domain, and it exposes your store as structured data rather than as HTML pages.

That last part is the whole reason a native app can exist. A wrapper needs your pages; a native app needs your data, and WooCommerce hands it over in a documented format.

The five endpoint families an app actually uses

A shopping app is a thin thing. It reads five kinds of data:

Products — the catalog. Names, prices, images, stock, categories, attributes, and for variable products the full variation list with per-variation prices.
Categories and attributes — the navigation and the filters. Attribute terms are what a color swatch picker is made of.
Customers — accounts, addresses, so a returning shopper does not retype anything.
Orders — order history, statuses, and the record created when someone buys.
Shipping and tax — zones, methods and rates, so a native address step can show real costs before the payment page.

Notice what is missing: there is no “checkout” endpoint that takes a card. Payment happens on your store’s own checkout pages with your own gateways, which is why your PCI scope and your settlement do not change when you add an app.

Authentication, in plain terms

Two mechanisms matter.

Consumer key and secret. WooCommerce can mint an API key pair with read or read/write scope. This is the classic approach, and it is what “paste your keys into the app builder” means. It works, and it puts a long-lived credential in someone else’s system.

An authorization handshake. WooCommerce also supports an auth endpoint where you approve access from inside your own wp-admin, and the store hands the credential back directly. Nothing is copied, nothing is pasted, and you can see and revoke the grant in WooCommerce → Settings → Advanced → REST API.

StoreToNative uses the second one — you click approve in your own admin and the catalog starts syncing. It is the same permission model, minus the copy-paste step where credentials most often leak into a Slack message.

Customer logins are separate. A shopper signing into the app is not using the store’s API key; they are authenticating as a customer. Their session lets the app read their orders and addresses and nothing else.

What makes API responses slow

This is where store owners can make a real difference, because most app slowness is one of five things:

Uncached repeated work. WordPress recomputes a lot of option and term data per request. A persistent object cache (Redis or Memcached) is the single largest improvement available to API traffic, and it is why hosting matters more for app-backed stores than for brochure sites.

Oversized images. If your product images are 4000 px JPEGs and the API hands back the full-size URL, the app downloads a 3 MB file to fill a 400 px thumbnail. WordPress generates smaller sizes; the app should use them, and your images should be sensibly sized to begin with.

Attribute filtering on big catalogs. Filtering by two attributes and a price range on 5,000 products is a genuinely expensive database query. It is also the most-used feature in a catalog app, which makes database RAM a conversion issue.

Plugins that hook everything. Every plugin that filters product data runs on API requests too. A plugin doing something clever on woocommerce_product_get_price runs once per product per response.

Too few PHP workers. Concurrency is bounded by worker count. An app’s opening burst — several requests at launch — hits this wall before a website would.

Staying in sync

There are two ways an app learns your prices changed.

Polling — ask periodically. Simple, and always a little stale.

Webhooks — WooCommerce tells the app the moment a product, order or customer changes. This is what you want: edit a price in wp-admin, and the app has it immediately, without a scheduled job.

StoreToNative registers webhooks on your store during the one-click connect, and product, price and stock changes propagate through them. You can see them in WooCommerce → Settings → Advanced → Webhooks, which is also the first place to look if the app’s data goes stale.

The five settings that break an app connection

When an app cannot reach a store, it is almost always one of these:

Permalinks set to “Plain.” The REST API needs pretty permalinks. This breaks more integrations than everything else combined.
A security plugin blocking /wp-json/. Some hardening presets disable the REST API for unauthenticated requests wholesale.
A firewall or CDN rule rate-limiting the API, which looks exactly like a slow store.
Mixed content or a bad certificate. An app will refuse a connection a browser would merely warn about.
A maintenance-mode plugin answering every request with a holding page, including API requests.

Our WordPress companion plugin checks this class of problem as part of its 14 store-readiness checks, because each one presents to the merchant as “the app is broken” rather than as a WordPress error.

What this means for you

You do not have to manage any of it, but knowing the shape helps you ask the right questions. When the app is slow, look at the object cache and image sizes before you blame the app. When data is stale, look at webhooks. When nothing connects at all, look at permalinks and your security plugin. And when a vendor asks you to paste API keys into their dashboard, know that there is a way that does not require it.

Related reading

StoreToNative connects in one click from your own wp-admin — no keys to copy. See how it works.