API Bearer Auth vs UCP Adapter For WooCommerce

The API Bearer Auth plugin enables authentication for the REST API by using JWT access an refresh tokens. After the user logs in, the access and refresh tokens are returned and can be used for the next requests. Issued tokens can be revoked from within the users admin screen. See below for the endpoints. Note that after activating this plugin, all REST API endpoints will need to be authenticated, unless the endpoint is whitelisted in the api_bearer_auth_unauthenticated_urls filter (see FAQ for how to use this filter). JWT Access tokens can be formatted as JWT tokens. For this to work, you first have to create a secret and add it to the wp-config.php file. If you don’t do this, access tokens will work also, but are just random strings. To create a random secret key, you can do for example: base64_encode(openssl_random_pseudo_bytes(64)); And then add the result to wp-config: define('API_BEARER_JWT_SECRET', 'mysecretkey'); If you have problems, you can verify your JWT tokens at: https://jwt.io/ Revoke tokens This plugin adds a column to the users table in de admin where you can see when a token expires. You can also revoke tokens by selection the “Revoke API tokens” from the bulk actions select box. API endpoints Note that all endpoints expect JSON in the POST body. Login Endpoint: POST /api-bearer-auth/v1/login Request body: Note: client_name is optional. But if you use it, make sure to use it as well for the refresh call! {"username": "my_username", "password": "my_password", "client_name": "my_app"} Response: { "wp_user": { "data": { "ID": 1, "user_login": "your_user_login", // other default WordPress user fields } }, "access_token": "your_access_token", "expires_in": 86400, // number of seconds "refresh_token": "your_refresh_token" } Make sure to save the access and refresh token! Refresh access token Endpoint: POST /api-bearer-auth/v1/tokens/refresh Request body: Note: client_name is optional. But if you did use it for the login call, make sure to use it here as well! {"token": "your_refresh_token", "client_name": "my_app"} Response success: { "access_token": "your_new_access_token", "expires_in": 86400 } Response when sending a wrong refresh token is a 401: { "code": "api_api_bearer_auth_error_invalid_token", "message": "Invalid token.", "data": { "status": 401 } } Do a request After you have the access token, you can make requests to authenticated endpoints with an Authorization header like this: Authorization: Bearer Note that Apache sometimes strips out the Authorization header. If this is the case, make sure to add this to the .htaccess file: RewriteCond %{HTTP:Authorization} ^(.*) # Don't know why, but some need the line below instead of the RewriteRule line # SetEnvIf Authorization .+ HTTP_AUTHORIZATION=$0 RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1] If you are not logged in or you send an invalid access token, you get a 401 response: { "code": "api_bearer_auth_not_logged_in", "message": "You are not logged in.", "data": { "status": 401 } } Important update Update immediately if you’re using a version below 20200807. Before this version all access tokens were updated when calling the refresh callback. If you are affected by this the fastest solution is to execute this query: update wp_user_tokens set access_token_valid = NOW(); This will invalidate all access tokens. This means that all users need to refresh their access token and will get a new access token and a unique one this time. A big thank to @harchvertelol for reporting this and suggesting the fix as well!

UCP Adapter For WooCommerce is a powerful WordPress plugin that provides REST API endpoints for Universal Commerce Platform (UCP) integration. It enables seamless communication between your WordPress site and external commerce platforms through secure, standardized API endpoints. Thank you for using our plugin! This add-on connects your WordPress site to the powerful world of WordPress’s Agentic Commerce, allowing you to create automated shopping assistants for your users. 🚀 Core Features Our plugin leverages WordPress’s MCP (Model Context Protocol) servers plugin and the open Universal Commerce Protocol (UCP) standard to enable secure, intelligent commerce actions. Here’s what you can build: Smart Product Discovery: Enable agents to search products across WordPress merchants, apply filters, and display interactive product cards directly within a chat interface on your site. Seamless Checkout: Allow agents to create checkout sessions, collect buyer information, attach payment details, and complete purchases on behalf of users. Order Tracking: After a purchase, agents can track order status, fulfillment updates, and post-purchase events like refunds or returns. 🔗 How It Works The plugin acts as a Platform within the UCP framework, facilitating secure communication between your users (buyers), WordPress Merchants, and payment or credential providers. It implements these key UCP capabilities: Discovery → Checkout: An agent can help a user find a product and instantly retrieve the necessary details to start a checkout session. Checkout Completion: The agent can securely submit the checkout. If further user action is needed, it can gracefully open a web checkout page. Post-Purchase: The agent provides ongoing value by fetching real-time updates on order delivery and status changes. 💡 Use Case Example Imagine a user in your site’s chat asking, “Find me a red coffee mug under $20.” The plugin-powered agent can: * Query the WordPress Catalog across multiple stores. * Return filtered, interactive results. * Guide the user through selecting a variant, adding it to cart, and checking out—all without leaving your WordPress environment. * Get this client https://github.com/dhirajpatra/adk-agent-gcp/tree/main/ai-agents-adk/ucp_recommendation_system to connect your site with AI agent. Key Features Session Management: Create and manage user sessions with automatic expiration REST API Endpoints: Three core endpoints (Session, Update, Complete) for UCP communication Security First: API key authentication, rate limiting, and IP whitelisting Developer Friendly: Clean, extensible code following WordPress coding standards Extensible: Hooks and filters throughout for custom implementations Admin Interface: Easy-to-use settings and session monitoring dashboard Database Storage: Efficient session storage with automatic cleanup REST API Endpoints POST /wp-json/ucp/v1/session – Create a new session PUT /wp-json/ucp/v1/update/{session_id} – Update session data POST /wp-json/ucp/v1/complete/{session_id} – Complete a session GET /wp-json/ucp/v1/status/{session_id} – Check session status GET /wp-json/ucp/v1/sessions – List all sessions GET /wp-json/ucp/v1/product/search – Search for products Use Cases E-commerce platform integration Third-party checkout systems Payment gateway connections Order management systems Multi-platform commerce solutions Developer Resources Build custom UCP adapters for platforms like: * Custom e-commerce solutions * Membership plugins * Digital product handlers * MemberPress API Documentation Create Session Endpoint: POST /wp-json/ucp/v1/session Headers: Content-Type: application/json X-UCP-API-Key: your-api-key Body: json { "platform": "woocommerce", "user_data": { "user_id": 123, "email": "[email protected]" } } Response: json { "success": true, "session_id": "ucp_abc123...", "expires_at": 1234567890, "message": "Session created successfully." } Update Session Endpoint: PUT /wp-json/ucp/v1/update/{session_id} Body: json { "action": "add_item", "data": { "product_id": 456, "quantity": 2 } } Complete Session Endpoint: POST /wp-json/ucp/v1/complete/{session_id} Body: json { "status": "completed", "metadata": { "order_id": 789 } } List Sessions Endpoint: GET /wp-json/ucp/v1/sessions Parameters: * page: Page number (optional, default 1) * limit: Results per page (optional, default 10) Response: json { "success": true, "data": [ { "session_id": "ucp_abc123...", "status": "active", "created_at": "2024-01-01 12:00:00", "expires": 1234567890 } ], "meta": { "page": 1, "limit": 10, "total": 5 } } Product Search Endpoint: GET /wp-json/ucp/v1/product/search Parameters: * search: Search query (required) * page: Page number (optional, default 1) * limit: Results per page (optional, default 10) Response: json { "success": true, "data": [ { "id": 123, "name": "T-Shirt", "price": "20.00", "image": "https://example.com/image.jpg", "permalink": "https://example.com/product/t-shirt" } ], "meta": { "page": 1, "limit": 10, "search": "shirt", "count": 1 } } Actions Available add_item – Add an item to the session update_item – Update an existing item remove_item – Remove an item from the session set_data – Set custom session data Custom actions via filters Privacy Policy UCP Adapter For WooCommerce stores session data temporarily in your WordPress database. This data is automatically cleaned up based on your configured retention settings. The plugin does not send any data to external services. Session data may include: * User identifiers * Platform information * Custom data provided via API calls It is your responsibility to ensure compliance with privacy regulations (GDPR, CCPA, etc.) when using this plugin. Credits Developed with WordPress coding standards and best practices in mind. Support Support Forum: https://wordpress.org/support/plugin/ucp-adapter-for-woocommerce