CoCart - Headless REST API for WooCommerce

"An excellent plugin, which makes building a headless WooCommerce experience a breeze. Easy to use, nearly zero setup time." — Harald Schneider ★★★★★ "This plugin works great out of the box for adding products to the cart via API. The code is solid and functionality is as expected, thanks Sebastien!" — Scott Bolinger, Creator of Holler Box ★★★★★ "Thanks for doing such great work with this! Works exactly as expected and CoCart seems to have a nice community around it. The founder seems really devoted and that’s one of the key things for a plugin like this to live on and get the right updates in the future. We just got ourselves the lifetime subscription." — Mighty Group Agency See our full wall of love for more developer testimonials.

• 🔐 Cookie-less sessions — database-stored, built for concurrent requests and stateless frontends
• 👤 Guest customer support — full cart session support for unauthenticated shoppers, no login required
• 🔄 Load any session into checkout — hand off to WooCommerce’s native checkout with any payment gateway

• ✅ Add, update, and remove items via simple POST/PUT/DELETE requests
• 🔎 Product search — query by name, SKU, or ID, authenticated or not, with flexible filtering
• 💸 Name Your Price support — donation-based and flexible pricing built in
• 📦 Bulk cart requests — combine multiple operations into a single API call

• 🔑 Flexible authentication — email, username, or phone login; no admin API keys to manage
• 🌍 CORS support built in — first-party CORS handling; your frontend connects without configuration hell
• 🧩 180+ filters — customize every response, add logic without writing new routes
• 📊 Cart insights — monitor active, expiring, and expired sessions from the dashboard
• 🛠 Works with your existing stack — built on WooCommerce Data Stores with familiar hooks for broad plugin compatibility

• Tested with every major WooCommerce release
• Multisite compatible

• 🎫 Coupon Management — apply discounts and promo codes, boost conversions
• 🚢 Shipping Calculations — real-time rates and method selection
• 💰 Cart Fees — handling fees, rush charges, and custom pricing logic
• 🥪 Advanced Batch API — multiple cart operations in a single request
• 🕒 Rate Limiting — protect your API from abuse under load
• 🧾 Checkout — complete orders with any WooCommerce-supported gateway (coming soon)
• 💲 Subscription Support — new subscriptions and renewals (coming soon)

• CoCart - Rate Limiting — add rate limiting to CoCart Plus
• CoCart - JWT Authentication — authenticate via JWT token

• cocart-js (TypeScript/JavaScript) — GitHub
• cocart-php (PHP) — GitHub
• cocart-python (Python) — GitHub
• cocart-go (Go) — GitHub

More are also in development and look forward to your feedback.

• CoCart OpenAPI Specs — generate client libraries or test with Postman/Insomnia/Yaak
• CoCart for VS Code — snippets and autocompletion for functions, classes, and hooks
• Raycast Extension — access CoCart docs without leaving your keyboard
• Cart Callback Example — register custom callbacks triggered on cart updates

• Website
• Documentation
• Follow on X/Twitter, GitHub, Facebook, Instagram

• WordPress v6.7
• WooCommerce v9.0
• PHP v7.4

• WordPress v6.7 or higher.
• WooCommerce v10.0 or higher.
• PHP v8.2 or higher.

• REST API: Authentication error check now only applies to requests CoCart authenticated itself, so WordPress's own nonce verification is no longer bypassed on other endpoints, including the batch endpoint. Reported by Naoki Kawahigashi.

Developer note: We don't recommend using plain permalinks as it reduces the performance of lookup but we added support should it be the only option for you. e.g. ?rest_route=/cocart/v2/products

• REST API: Recognize requests made via the ?rest_route= query parameter (plain permalinks).
• WordPress Dashboard: Prevent enabling integrations without a loader module.

• Tested with WooCommerce v11.1

• REST API: Session handler now verifies ownership of the requested cart key before loading cart data, regardless of whether it was supplied via parameter or header.

[!IMPORTANT] PHP 7.4 is once again the minimum requirement to install and use CoCart. While PHP 7.4, 8.0, and 8.1 are past end-of-life/security support, we recognize many hosts still run them, and we don't want that to be a barrier to using CoCart. For the best performance and security, we still recommend running PHP 8.2 or later, but CoCart will continue to function correctly on 7.4+.

• Reverted PHP version to 7.4 as the minimum requirement to install and use CoCart.

• REST API: Checks the product's password directly rather than post_password_required() function.

• Tested with WordPress 7.1

• REST API: Products that have password protection were still accessible. Now return as invalid ID when accessed directly and are excluded from results.

• Tested with WooCommerce v11

• REST API: Fixed adding to cart via the v2 add item controller not checking stock for the combined quantity when an item already existed in the cart, allowing the cart to exceed available stock.
• REST API: Fixed the "Update Cart" callback not checking stock before setting a new item quantity, allowing the cart to be updated beyond available stock.
• Plugin: Fixed cocart_update_plugin_suggestions scheduled action never running via WP-Cron or WP-CLI — the callback was only registered on admin_init and the updater class only loaded when is_admin() was true, so Action Scheduler could not find a registered callback and the action was never rescheduled. Fixes #576 reported by @isam-aqu.

• REST API: Standardized "not enough stock" error messages across v1 and v2 cart controllers into a single consistent format.

• Plugin: Updated styling for the WooCommerce floating admin header refreshed in WooCommerce v10.9.

[!WARNING] PHP version 8.2 is the minimum requirement to install and use CoCart. PHP 7.4, 8.0, and 8.1 are all past end-of-life/security support so to help manage development resources to maintain CoCart, it will no longer be tested on these versions. Running CoCart on PHP 8.2 not only ensures you are secure but it also improves the performance of the CoCart API. Thank you for your understanding.

• REST API: Added ETag support for all cart endpoints (GET/POST/PUT/DELETE) enabling conditional requests with If-None-Match header for immediate use.
• REST API: Added ETag support for product endpoints (products, categories, tags, attributes, reviews).
• REST API: Added CoCart-Cache response header indicating cache status: HIT, MISS, or SKIP.
• REST API: Added _skip_cache query parameter to bypass caching for individual requests.
• REST API: Added stale-while-revalidate directive to cacheable routes (products) for improved performance.
• REST API: Added check for X-HTTP-Method-Override header if it exists during authentication.
• WordPress Dashboard: New integrations page to provide more control over which supported plugin is running when making a CoCart request.
• Plugin: New settings page providing quick easy control of CoCart without touching code for the following:
• • CORS and allowed origin.
• • Authorization header server variable.
• • Session expiration for guest and logged-in users.
• • "Load Cart from Session" feature.
• • "Name Your Price" feature.

Settings show a locked state when controlled by an external filter with a link providing information as to what and where.

• REST API: Requests made via the WordPress REST API batch endpoint were not recognized and caused a fatal error when adding items.
• REST API: Shipping address fields were blank after submitting billing-only details — billing fields now mirror to shipping when ship_to_different_address is not set, matching WooCommerce checkout behaviour. Shipping packages now also return correctly after a complete address is saved.
• REST API: Slugs, permalinks and attribute names with non-ASCII characters (e.g., Chinese, Arabic) are now returned decoded instead of encoded across all product and cart endpoints.
• REST API: Authentication not determining user in time when rest_url_prefix filter is used causing several cloned guest sessions with cart items.
• REST API: Fixed fatal error when adding an invalid product to cart via v2 controller due to missing WP_Error check after product validation.
• REST API: Corrected Last-Modified header in GMT per HTTP spec with more robust date parsing.
• Plugin: Fixed cocart_deprecated_filter() returning null when the debug log was active, causing callers to receive no value from the deprecation wrapper.

• REST API: Fixed warnings for undefined array keys cart_item_data and cart_item_key in v1 add item controller.
• Session: Fixed warning for undefined array key total in session handler cart hash generation.
• Plugin: Fixed warnings for undefined array key count when database queries return no results in cart counting functions.
• Plugin: Fixed warning for undefined variable $per_page in admin plugin search.
• Plugin: Fixed deprecated ${var} string interpolation syntax in plugin update screen.

• Session: Removed the max expiration exceed limit of 30 days to allow adjusting the lifetimes via the cocart_cart_expiring and cocart_cart_expiration filters as needed.

Dev note: You will still be warned "Keeping sessions for longer than X days can cause performance issues and larger session tables."

• REST API: Slight performance increase by preventing admin content from loading in the background for every REST request made.
• REST API: cocart_upload_file() and cocart_upload_image_from_url() now use a try/finally block to guarantee the upload_dir filter is always removed, even when an exception is thrown during upload.
• REST API: cocart_upload_image_from_url() now uses wp_parse_url() to extract the filename from the image URL, correctly stripping query strings instead of splitting on ?.
• Session: Adjusted get_session() using wp_cache_set() instead of wp_cache_add(), which caused stale persistent object cache entries to never be overwritten.
• Session: Adjusted get_session() and update_cart() using an uninitialized expiration value on frontend requests, preventing sessions from being cached after a database read.
• Session: Adjusted save_data() writing to object cache with a potentially negative TTL when session expiration was stale or unset.
• Session: Adjusted update_cart() not syncing the object cache after a database write, causing subsequent reads to return stale cached data.
• Session: Added get_cache_expiration() helper to reliably resolve cache expiration across both REST API and frontend contexts.

• REST API: The cocart_does_product_allow_price_change filter now defaults to false. Price overrides via the price parameter on cocart/v2/cart/add-item are disabled by default. To restore the previous behaviour, add add_filter( 'cocart_does_product_allow_price_change', '__return_true' ); — or return true conditionally for specific products only.

• Logger: Log entries now include a source line identifying the calling class, method, file, and line number for easier debugging.
• Introduced new filter cocart_etag_cart_routes to customize which cart routes support ETag.
• Introduced new filter cocart_etag_product_routes to customize which product routes support ETag.
• Introduced new filter cocart_etag_routes to add ETag support for third-party plugin routes.
• Introduced new filter cocart_cache_max_age to customize cache duration (default: 1 hour).
• Introduced new filter cocart_stale_while_revalidate to customize stale-while-revalidate duration (default: 24 hours).

• Filter cocart_secure_registered_users deprecated for security — unauthenticated access to registered user carts is now always blocked.

• Tested with WordPress 7.0
• Tested with WooCommerce v10.9

• Plugin: Fixed fatal error from sprint_f() typo in database update scheduler (sprintf).
• REST API: Apply Access-Control-Allow-Credentials header correctly.
• Load Cart: Only trigger warning if hook cocart_load_cart_override was used.
• Load Cart: Fixed uncaught type error merging an empty cart value. Reported by @allkhor 👍
• WordPress Dashboard: Fixed HTML issue in the WooCommerce admin bar title.

• Tested with WooCommerce v10.7

• REST API: Updating a customer address after one is placed would not update.
• REST API: Return error responses correctly so all headers return.

• Plugin: Updated broken external links throughout the plugin.

• Plugin: WordPress plugin checker helped resolve a few PHP code standards.

• Tested with WordPress 6.9
• Tested with WooCommerce v10.4

• REST API: Updating a customer address after one is placed would not update.
• REST API: No customer data, no applied coupons or removed items in session caused undefined errors.
• REST API: Customer data was not converting correctly to return in the Session API.
• REST API: The product object was not passed correctly in the Session API for items.
• REST API: Damaged or empty cart sessions was failing in the Session API.

• Plugin: WordPress plugin checker helped resolve a few database issues to keep up with security practices.

• Tested with WooCommerce v10.3
• Added support for the next CoCart Plus update.

• Authentication: Enhanced login endpoint with improved permissions control via the new hooks mentioned below.

• Authentication: Removed priority order so our JWT Auth integration can run earlier in the process.
• Authentication: Refactored get_ip_address for better trusted proxy support and better IP address detection with additional headers.
• REST-API: Session handler now loads during the login endpoint operations.
• Security: Item keys are now restricted to 32 characters maximum for better validation.
• User Management: Refactored is_user_customer function to support additional user roles beyond just customers.

• Logging: Added informational logs for IP address detection and proxy handling.
• Introduced a new filter cocart_login_permission_callback allows additional authentication checks after basic authorization for the login endpoint.
• Introduced a new filter cocart_login_secure_auth_methods determines which authentication methods should skip additional auth checks.
• Introduced a new filter cocart_login_query_parameters allows plugins to add additional parameters to the login endpoint.
• Introduced a new filter cocart_trusted_proxies allows adding trusted proxy IPs/CIDR for secure IP detection.
• Introduced a new filter cocart_ip_headers allows customization of headers used for IP address detection.
• Introduced a new hook cocart_login_permission_granted that triggers when login permission is granted for the login endpoint.

• Tested with WooCommerce v10.2