The Complete WooCommerce Store API Guide 2026
The WooCommerce Store API is the public REST API powering Cart and Checkout blocks and headless carts — products, cart and checkout without authentication, built for frontends.
The WooCommerce Store API is WooCommerce’s public-facing REST API designed for storefronts — it powers the Cart and Checkout blocks and is the right tool for headless cart and checkout flows. Unlike the admin REST API, the WooCommerce Store API needs no authentication for reads and manages cart state for shoppers, exposing products, cart operations and checkout (per the WooCommerce APIs index) under the /wp-json/wc/store namespace. If you are building anything customer-facing on WooCommerce data, this is the API to know.
Search intent: informational/procedural — WooCommerce developers building storefront, block, or headless cart experiences. We cover what the WooCommerce Store API is, how it differs from the admin REST API, cart and checkout, nonces and cart tokens, headless use, and extending it. It builds on our headless WooCommerce and WPGraphQL guides.
WooCommerce Store API vs the Admin REST API
The crucial distinction: the admin REST API (/wc/v3) is for management — it requires API keys, exposes orders and admin data, and is meant for server-to-server integration. The WooCommerce Store API (/wc/store) is for storefronts — public, no authentication for reads, and built around the shopper’s cart. You use the admin REST API for back-office sync (and webhooks for events), and the WooCommerce Store API for anything the customer’s browser touches: listing products, adding to cart, applying coupons, and checking out. Mixing these up — exposing the admin API to the frontend — is a serious security mistake (the WordPress REST API handbook explains the auth model) the WooCommerce Store API exists to prevent.
WooCommerce Store API: Cart, Checkout and Tokens
What makes the WooCommerce Store API distinctive is that it is stateful around the cart. Endpoints under /wc/store/v1/cart add items, update quantities, apply coupons and read totals, and the API tracks the cart per shopper. Two mechanisms matter: the WooCommerce Store API uses a Nonce (or the newer Cart-Token header) to associate requests with a cart and protect state-changing operations, so your client must read and send these tokens on cart mutations. Checkout is handled by the /wc/store/v1/checkout endpoint, which processes the order from the current cart. This is exactly the surface the Cart and Checkout blocks use internally, which is why the WooCommerce Store API is the supported path for customising those blocks and for headless carts. The Store API documentation details every endpoint and the token handling.
| Aspect | Store API (/wc/store) | Admin REST API (/wc/v3) |
|---|---|---|
| Purpose | Storefront / customer-facing | Management / back-office |
| Auth | Public (nonce/cart-token) | API keys required |
| Cart state | Stateful per shopper | Stateless |
| Powers | Cart + Checkout blocks, headless | Integrations, sync |
| Exposes orders | Only current checkout | All orders (admin) |
WooCommerce Store API: Headless and Extending
For headless WooCommerce, the WooCommerce Store API is the natural choice for cart and checkout because it manages cart state for you — a custom frontend reads products, mutates the cart with token handling, and posts checkout, all without reimplementing cart logic. It pairs well with WPGraphQL for content/catalogue reads while using the WooCommerce Store API for the stateful cart flow. You can also extend the WooCommerce Store API: the StoreAPI extensibility system lets plugins add data to cart and checkout responses and register endpoints, so custom fields (gift messages, delivery dates) flow through blocks and headless alike. This extensibility is what keeps the WooCommerce Store API viable for real stores rather than just simple catalogues. Our WooCommerce team builds headless carts and block customisations on it.
What we have learned working with the WooCommerce Store API
Cart tokens trip up most first builds. The Store API’s nonce and Cart-Token handling is the part teams miss — cart mutations fail or lose state until the client correctly reads and returns the token on each request. We treat token handling as the first thing to get right in any Store API integration.
It is the supported way to customise checkout blocks. Teams try to hack the Checkout block directly; the right path is the Store API extensibility system. Adding data through the documented endpoints means your customisations survive WooCommerce updates instead of breaking with the blocks.
Use it alongside WPGraphQL, not instead of it. The strongest headless WooCommerce stacks we build read catalogue and content via WPGraphQL and run the stateful cart and checkout through the Store API — each API doing what it is best at rather than forcing one to do everything.
Frequently Asked Questions About WooCommerce Store API
What is the WooCommerce Store API?
The WooCommerce Store API is WooCommerce’s public, storefront-facing REST API under /wp-json/wc/store. It powers the Cart and Checkout blocks and headless cart flows, exposing products, stateful cart operations and checkout without authentication for reads — distinct from the admin REST API used for management.
What is the difference between the Store API and the WooCommerce REST API?
The Store API (/wc/store) is public and storefront-facing, stateful around the shopper’s cart, and powers blocks and headless carts. The admin REST API (/wc/v3) requires API keys and is for back-office management and integrations. Use the Store API for customer-facing flows and the admin API for server-side sync.
Does the WooCommerce Store API require authentication?
No authentication is required for reads — it is public by design for storefronts. For cart mutations and checkout it uses a Nonce or the Cart-Token header to associate requests with a cart and protect state changes, so your client must read and send those tokens, but you do not need API keys as with the admin REST API.
Can I use the WooCommerce Store API for headless checkout?
Yes — it is the natural choice for headless cart and checkout because it manages cart state for you. A custom frontend reads products, mutates the cart with proper token handling, and posts to the checkout endpoint. Many headless stacks pair the Store API for cart with WPGraphQL for catalogue and content reads.
Can the WooCommerce Store API be extended?
Yes. The Store API extensibility system lets plugins add data to cart and checkout responses and register endpoints, so custom fields like gift messages or delivery dates flow through both the Cart and Checkout blocks and headless frontends. This is the supported way to customise checkout, surviving WooCommerce updates.
What powers the WooCommerce Cart and Checkout blocks?
The Cart and Checkout blocks use the WooCommerce Store API internally for all their data and cart operations. This is why the Store API, and its extensibility system, is the supported path for customising those blocks — work with the API rather than hacking the block markup, so customisations remain stable across updates.
Building Storefront or Headless Carts on WooCommerce?
Our team builds on the Store API — block customisations, headless carts, and checkout extensions.
