Svelte Commerce on WooCommerce

What works on WooCommerce today

Known gaps: auth (no core endpoint), wishlist

27 of 43 services wired, read from CONNECTORS.md on 21 September 2026; npm may carry a newer patch. How coverage is measured.

What the connector calls on WooCommerce

The connector calls three WordPress REST namespaces on the store’s own URL: WooCommerce wc/v3 at /wp-json/wc/v3 for the catalogue, orders and customers, the Store API at /wp-json/wc/store/v1 for the cart and checkout, and WordPress core at /wp-json/wp/v2 for pages.

Calls to wc/v3 carry the consumer key and secret as Authorization: Basic; Store API calls carry no key and instead replay the Cart-Token and Nonce headers captured from the previous response, with the cart token also kept in localStorage as cart_id; shopper sign-in is not possible, because every sign-in method throws NotSupportedError.

WooCommerce rules the connector follows

• List totals come from the X-WP-Total and X-WP-TotalPages response headers, not the body, and a route that sends neither falls back to the length of the returned array.
• Sorting goes out as an orderby and order pair, orderby is limited to the values WooCommerce accepts (date, modified, id, title, slug, price, popularity, rating, menu_order), and an unknown sort becomes date desc rather than a rest_invalid_param error.
• GET /products/{id} takes only a numeric id, so a product page reached by slug first runs GET /products?slug=&per_page=1, then fetches variations 100 at a time, which is WooCommerce’s maximum page size.
• Every Store API write needs the Nonce from an earlier response as well as the Cart-Token, so the connector captures both from the response headers on every cart call.
• WooCommerce has no endpoint that confirms a payment, so the connector leaves every capture method unimplemented rather than marking an order paid with set_paid, and only cod, WooCommerce’s own gateway, is driven end to end.

Read from the source of misiki-in/woocommerce-connector at commit af8ed2c of 25 August 2026. Where the code has changed since, the code is right.

Quick start

From nothing to a Svelte Commerce storefront reading WooCommerce. You need Node.js and a WooCommerce to point it at; the storefront holds no data of its own.

# 1 — get the storefront
git clone https://github.com/itswadesh/svelte-commerce
cd svelte-commerce

# 2 — one connector at a time: remove the two the storefront ships with, add this one
npm uninstall @misiki/litekart-connector @misiki/vendure-connector
npm i @misiki/woocommerce-connector

# 3 — point it at your WordPress site
echo PUBLIC_WOOCOMMERCE_API_URL=https://your-store.example.com >> .env
echo PUBLIC_WOOCOMMERCE_API_KEY=ck_... >> .env
echo PUBLIC_WOOCOMMERCE_API_SECRET=cs_... >> .env

# 4 — run it
npm run dev

Switching works the same way on every backend: what all 26 share, from one connector at a time to store identity.

Environment variables

init.ts hands the connector every PUBLIC_WOOCOMMERCE_* variable that is set, camel-cased. The guide also lists PUBLIC_WOOCOMMERCE_ACCESS_TOKEN, PUBLIC_WOOCOMMERCE_ACCESS_KEY, PUBLIC_WOOCOMMERCE_STORE_ID and PUBLIC_WOOCOMMERCE_CHANNEL_ID; the connector’s source does not read them. The guide’s own example sets only the URL — the key and secret here are what wc/v3 calls authenticate with.

Every variable here begins PUBLIC_, and SvelteKit sends PUBLIC_ variables to the browser: treat each value you set as published.

What to set up on WooCommerce

• Create a REST API key under WooCommerce › Settings › Advanced › REST API for PUBLIC_WOOCOMMERCE_API_KEY and PUBLIC_WOOCOMMERCE_API_SECRET — and read the limitations first.
• Keep pretty permalinks on: the connector calls /wp-json/… paths.
• Let the storefront’s origin make cross-origin requests to WordPress (CORS): in production the browser calls PUBLIC_WOOCOMMERCE_API_URL directly, not only the server.

How the integration works

The connector reads the catalogue, orders, coupons and customers from wc/v3 with the consumer key and secret; runs the cart and checkout through the Store API, wc/store/v1, where a session Cart-Token carries the basket; and reads pages from WordPress core’s wp/v2. Cart and checkout exist only in the Store API.

Limitations on WooCommerce

• The consumer key and secret the connector sends to wc/v3 come from PUBLIC_WOOCOMMERCE_API_KEY and PUBLIC_WOOCOMMERCE_API_SECRET. SvelteKit sends PUBLIC_ variables to the browser, so every visitor to the store can read them and call wc/v3 with whatever permissions the key has.

Before you rely on it