The WordPress plugin

The StoreToNative plugin runs on your own WordPress site and does five things. Everything else, including catalog sync and push, works without it.

• Code pairing. Paste a short code from the console instead of creating REST keys by hand.
• Deep-link hosting. Serves the two files iOS Universal Links and Android App Links require, from your own domain.
• Smart install banner. Shows mobile visitors a “get the app” bar once your app is published.
• Store readiness checks. Looks over your WooCommerce settings for the things that quietly break a mobile app and tells you exactly which screen fixes each one.
• Shopper sign-in. Lets shoppers sign in to the app with their existing WooCommerce customer account. Sign-in runs between your site and the app; passwords never reach StoreToNative.

Requirements

WordPress 6.5 or newer, WooCommerce 8.0 or newer, PHP 8.0 or newer, and a store served over https. The plugin refuses to pair over plain http. It declares compatibility with WooCommerce’s High-Performance Order Storage and does not read or write order data itself.

Install and pair

1. Install StoreToNative from the WordPress plugin directory: in your WordPress admin go to Plugins → Add New Plugin, search for StoreToNative, then Install Now and Activate, or open the listing at wordpress.org/plugins/storetonative. Installing from the directory means WordPress delivers every update for you. You can also upload the zip from the console (App Builder → WooCommerce → Companion plugin, or the wizard’s Access step). Activate it either way. WooCommerce must already be active.
2. Open the new StoreToNative menu in your wp-admin sidebar.
3. In the console, press Generate pairing code (wizard Access step, or App Builder → WooCommerce → Companion plugin → Finish pairing). Codes last 15 minutes.
4. Enter the code on the plugin’s connect screen.

The plugin creates a WooCommerce REST key for itself, sends it to StoreToNative once, and StoreToNative calls your site back to confirm the pairing really came from it. The plugin then reports Paired in both places. Pairing sends nothing until you enter a code; installing or activating the plugin alone makes no network requests.

If pairing fails with a site could not be verified message, something on your host is stopping StoreToNative from reaching your site’s REST API for a few seconds: a web application firewall blocking /wp-json/storetonative/, a host with a single PHP worker, a per-process object cache, or a site that takes more than ten seconds to answer. The code is spent either way, so generate a new one after fixing the cause.

Store readiness

The Store readiness card works before you pair. Each row names the problem, what it costs you, and the wp-admin screen that fixes it. A blocker is a setting that makes the app unusable for shoppers until it is fixed; the console shows the verdict beside your publishing checklist for information, and does not stop a build on it.

Check	What it looks at	Severity
Store visibility	WooCommerce “Coming soon” mode is still on, so the app would show an empty store.	Blocker
Secure web address (HTTPS)	The site must be served over https.	Blocker
Published products	There is at least one published product.	Blocker
Payment methods	At least one payment method is enabled.	Blocker
Product web addresses	Permalinks are not “Plain”; the app needs pretty product URLs for deep links.	Blocker
Price sorting and filters	The product lookup table is stale. The card offers Rebuild price index.	Warning
Shipping	At least one shipping zone exists.	Warning
Guest checkout	Whether shoppers can check out without an account.	Warning
Checkout page	The checkout page exists and is assigned.	Warning
Site icon	A site icon of at least 512 × 512, so the wizard can offer it as the app icon.	Warning
Digital download products	Products that are both virtual and downloadable are excluded from the app.	Warning
Colour and size swatches	A swatch plugin that conflicts with the app’s option pickers.	Warning
WordPress, WooCommerce and PHP versions	The minimums above.	Warning

Once paired, the same verdicts appear in the console so your team sees them without logging into your store. Only the check names and a one-word verdict are sent, never the values or any text from your site.

Deep links

iOS and Android will only open a product link in your app if two small files are served from your store’s own domain: /.well-known/apple-app-site-association and /.well-known/assetlinks.json. The plugin serves both and keeps them up to date with your Apple Team ID and Play signing fingerprint as you fill them in on the Publish page. Your app’s own Android upload key is listed automatically, so direct installs open product links before you have filled in the Play fingerprint; installs from Google Play need the Play fingerprint too. If a physical file with the same name exists on your server it shadows the plugin’s copy, and the plugin warns you.

Without the plugin, the Growth page lets you download the two files to upload yourself. See Growth kit.

Smart install banner

A single switch on the plugin’s dashboard. Mobile visitors to your website get a lightweight “get the app” bar; on iOS Safari the plugin adds the apple-itunes-app tag so Safari’s own banner takes over. The banner’s script is bundled with the plugin and never loaded from elsewhere, and it never appears inside your app. Use either the plugin’s banner or the snippet on the Growth page, not both.

Shopper sign-in

When the Shopper accounts add-on is on and the plugin is paired, shoppers can sign in, create an account, reset a password and delete their account from inside the app, all against your own WordPress users. WordPress checks the password exactly as your login form does.

Accounts that can run your store cannot sign in to the app: administrators, shop managers, editors, authors, and anyone else who can write posts or manage WooCommerce. To try the app as a shopper, use a customer account. Custom customer roles such as wholesale customers work.

If you protect wp-login.php by its address, with a hidden login URL, an IP allowlist or server password protection, apply the same protection to /wp-json/storetonative/v1/shopper/. It is a second place your site checks passwords.

Checkout fields

When the Native checkout add-on is on, the app’s delivery form asks for exactly what your own checkout page asks for: your field labels, which fields are required, the countries you sell to, and the state or governorate lists. The plugin describes that form over a read-only route on your site. It sends nothing anywhere.

What the plugin sends

After pairing, the plugin sends a small heartbeat so the console can show the connection is healthy: once right after pairing, roughly once a day, at most every 12 hours while you work in wp-admin, and whenever you press Check connection. It carries the plugin, WordPress and WooCommerce versions, its feature names, whether customer registration is on, and the readiness verdicts. It never sends orders, customers, content or settings values.

There is one exception, and it only happens when a shopper asks for it: when a shopper deletes their account from the app, the plugin erases the account on your site using WooCommerce’s own personal-data erasers and sends StoreToNative one notice with the deleted user’s numeric id and a one-way hash of the email, so StoreToNative can delete its own sign-in record. No password, token or other data is included.

Disconnect on the plugin’s screen sends one notice so the console marks the store as disconnected. Uninstall removes the pairing, settings, cache, signing key and the REST key the plugin created, and makes no network request.