Ask your AI about your WooCommerce store

Six screens in WordPress, then one in your assistant. Two of them catch almost everybody: the consumer secret is shown exactly once and cannot be read again, and the store address has to be the form your store actually answers on. WooCommerce redirects between the www and non-www spellings, and HeyMetra will not follow a redirect to an address nobody checked.

1. 1

   Open the REST API screen in WordPress

   Sign in to the store's WordPress admin and go to WooCommerce → Settings → Advanced → REST API. The screen lists the keys the store has already issued, and has an Add key button.

   It is under WooCommerce, not under the WordPress Settings menu. WordPress has an unrelated Settings of its own, and there is no REST API tab in it.

2. 2

   Add a key, and choose what it may do

   Choose Add key, give it a description you will recognise later, and pick a user who can see orders. Then set Permissions: Read if this assistant should only answer questions, or Read/Write if you also want it to propose changes to products, prices and orders. Then Generate API key.

   The choice is yours and WooCommerce enforces it: with a Read key the store itself refuses any change, so nothing can be edited even by mistake. A Read/Write key lets the store accept changes, and HeyMetra still shows you every change as a card and does nothing until you approve it. HeyMetra cannot see which you picked, which is why it asks you separately on this screen. Either way the key inherits the chosen user's rights, so a user who cannot see orders produces a key that cannot either.

3. 3

   Copy the consumer key and the consumer secret

   Both appear once, on the screen that follows Generate. The consumer key starts with ck_ and the secret with cs_, so they cannot be confused with one another.

   Leaving that screen loses the secret for good. WordPress does not show it again, and the only remedy is to revoke the key and issue another.

4. 4

   Paste the secret into HeyMetra

   Choose WooCommerce on the Connections screen and paste the consumer secret. It is stored encrypted and never shown again, here or anywhere else.

5. 5

   Enter the store address exactly as the store answers

   https:// and the host, nothing after it. If the store answers at www.yourstore.com, type the www.; if it answers without it, leave it out. Saving checks the address and the key against the store immediately.

   HeyMetra does not follow a redirect from the address you give it, because that would let a store send it somewhere nobody checked. So the wrong half of a www. pair fails rather than quietly working.

6. 6

   Add HeyMetra to the assistant you use

   Claude, ChatGPT, Grok, Perplexity, Claude Code, Codex, Cursor or Antigravity. You paste one address and sign in once, and your store answers in that assistant once it connects.

Then add HeyMetra where you ask

Claude ChatGPT Grok Perplexity Claude Code Codex Cursor Antigravity

Six things that actually go wrong here, and four of them are WordPress's doing rather than the store's. They are written as you see them, because on this connector the cause and the symptom rarely resemble each other: a permalink setting and a firewall rule produce the same 404, and a wrong key and a missing key produce the same login error.

Saving fails and the answer says the store redirected the request.

The address on the connection is one the store redirects away from, almost always because of a www. that belongs or one that does not. Measured on a live store: the www. form answers 301 and names the address that works.

The message names the address the store redirected to. Put that one on the connection, without the path, and save again.

Saving fails with a login error and both values were copied carefully.

WooCommerce answers a wrong key and a missing key with the same error, so its own message cannot tell you which half is at fault. The usual cause is the secret: it is shown once, and a copy that caught a trailing space or missed a character looks right.

Revoke the key on the REST API screen and issue a new one, copying both values in one sitting. Nothing was stored, so there is nothing to undo.

Saving fails and the store's own /wp-json address opens a 404 page in a browser.

WordPress permalinks are set to Plain. The REST API is reachable at a query-string address in that mode, which is not the address any client uses.

In WordPress, Settings → Permalinks, choose anything other than Plain and save. The setting affects the whole site, so check the store's pages still open as expected.

The connection saves, and an assistant reports no orders for a period you know you sold in.

The period genuinely holds none. Unlike a marketplace, WooCommerce keeps the store's whole history, so an empty answer here is the store's answer rather than a retention limit.

Ask about a wider period. If the store's own Orders screen shows rows in the same dates, check the key's user can see orders. A key made for a customer account reads none.

The sales report answers zero for a period the store plainly sold in, and your assistant adds the orders up instead and says so.

The store keeps orders in WooCommerce's newer storage (HPOS) with compatibility mode off. The sales report reads the older tables, which nothing writes to any more, so it reports nothing sold. Measured on a live 9.4.5 store, for a whole year it had sold in.

Turn on WooCommerce → Settings → Advanced → Features → compatibility mode. It fills the old tables from the new ones from that point on, so figures from before it was turned on stay missing there. That is worth knowing before you compare two periods across that date. Until then your assistant can still answer about revenue, by adding up the orders themselves; it will say that it did. What it must not do is repeat the report's zero, and if you are ever shown a flat zero for a period you know you sold in, this is the reason.

The connection worked and now every question fails to reach the store.

A security plugin or the host's firewall is blocking /wp-json, which several of them do by default after an update.

Allow /wp-json in the plugin's settings, or allow HeyMetra's address. Opening the store's /wp-json in a browser shows whether the block is there rather than in the credential.