HubACP Documentation

Welcome to the complete guide for HubACP (WooCommerce Agentic Commerce Protocol) - the definitive API that empowers AI agents to interact with your WooCommerce store.

Getting Started

HubACP provides a comprehensive REST API that allows AI agents to browse products, manage checkouts, and complete purchases in your WooCommerce store. This guide will help you get up and running quickly.

What You'll Need

  • WordPress 6.0 or higher
  • WooCommerce 8.0 or higher
  • PHP 8.1 or higher
  • SSL certificate (HTTPS recommended for production)

Installation

Option 1: Install from WordPress.org (Free Version)

  1. Log in to your WordPress admin panel
  2. Navigate to Plugins → Add New
  3. Search for "HubACP"
  4. Click Install Now and then Activate

Option 2: Manual Installation

  1. Download the plugin ZIP file from WordPress.org
  2. Navigate to Plugins → Add New → Upload Plugin
  3. Choose the downloaded ZIP file and click Install Now
  4. Click Activate Plugin

Option 3: Pro Version

  1. Purchase and download the Pro version from our website
  2. Navigate to Plugins → Add New → Upload Plugin
  3. Upload the Pro ZIP file and activate
  4. Enter your license key in WooCommerce → Settings → HubACP

Configuration

Step 1: Access Settings

Navigate to WooCommerce → Settings → HubACP in your WordPress admin panel.

Step 2: Generate API Credentials

Click the "Generate New Credentials" button to create your API key and signing secret.

Generated Credentials
API Key: wcp_abc123def456ghi789
Signing Secret: sec_xyz789abc123def456

⚠️ Important Security Note

Store your signing secret securely. Never commit it to version control or expose it in client-side code. This secret is used to verify webhook signatures and API requests.

Step 3: Configure Webhook URL (Pro Only)

If you're using the Pro version, configure your webhook endpoint URL to receive real-time order updates.

Example Webhook URL
https://your-ai-agent.com/webhooks/hubacp

API Overview

The HubACP API is organized around REST principles with predictable, resource-oriented URLs. It uses standard HTTP response codes and returns JSON-encoded responses.

Base URL

https://your-store.com/wp-json/acp/v1/

API Capabilities

🔍 Product Discovery

Browse, search, and filter your entire product catalog with pagination support.

🛒 Checkout Management

Create and manage checkout sessions with cart items, shipping, and tax calculations.

💳 Order Completion

Finalize purchases and create WooCommerce orders with a single API call.

🔔 Real-time Webhooks

Receive instant notifications for order status changes and events.

Authentication

HubACP uses API key authentication with HMAC signature verification for secure communication.

Authentication Header

HTTP Headers
X-WCP-API-Key: wcp_abc123def456ghi789
X-WCP-Signature: sha256=
Content-Type: application/json

Generating HMAC Signature

For write operations (POST, PUT, DELETE), you must include an HMAC signature of the request body.

JavaScript Example
const crypto = require('crypto');

const payload = JSON.stringify(requestBody);
const signature = crypto
  .createHmac('sha256', signingSecret)
  .update(payload)
  .digest('hex');

const hmacHeader = `sha256=${signature}`;
Python Example
import hmac
import hashlib
import json

payload = json.dumps(request_body)
signature = hmac.new(
    signing_secret.encode(),
    payload.encode(),
    hashlib.sha256
).hexdigest()

hmac_header = f"sha256={signature}"

API Endpoints

Products API

GET /wp-json/acp/v1/products

Retrieve a paginated list of products from your catalog.

Query Parameters

Parameter Type Description
search string Search query for product name or description
category string Filter by category slug
page integer Page number (default: 1)
per_page integer Items per page (default: 20, max: 100)
orderby string Sort by: date, title, price (default: date)
order string Sort order: asc, desc (default: desc)

Example Request

GET /wp-json/acp/v1/products?search=shirt&per_page=10
X-WCP-API-Key: wcp_abc123def456ghi789

Example Response

{
  "products": [
    {
      "id": 123,
      "name": "Classic Cotton T-Shirt",
      "slug": "classic-cotton-tshirt",
      "price": "29.99",
      "regular_price": "39.99",
      "sale_price": "29.99",
      "on_sale": true,
      "stock_status": "instock",
      "stock_quantity": 50,
      "description": "Comfortable 100% cotton t-shirt",
      "short_description": "Classic everyday tee",
      "images": [
        {
          "src": "https://your-store.com/wp-content/uploads/tshirt.jpg",
          "alt": "Classic T-Shirt"
        }
      ],
      "categories": ["Clothing", "T-Shirts"],
      "variations": []
    }
  ],
  "pagination": {
    "total": 150,
    "pages": 15,
    "current_page": 1,
    "per_page": 10
  }
}

Checkout Sessions API (Pro Only)

POST /wp-json/acp/v1/checkout-sessions

Create a new checkout session with cart items.

Request Body

{
  "items": [
    {
      "product_id": 123,
      "quantity": 2,
      "variation_id": null
    }
  ],
  "customer": {
    "email": "customer@example.com",
    "first_name": "John",
    "last_name": "Doe"
  },
  "idempotency_key": "unique-request-id-123"
}

Example Response

{
  "session_id": "cs_abc123",
  "status": "pending",
  "items": [...],
  "subtotal": "59.98",
  "tax": "5.40",
  "shipping": "0.00",
  "total": "65.38",
  "expires_at": "2025-01-15T18:30:00Z"
}
POST /wp-json/acp/v1/checkout-sessions/{id}/shipping

Calculate shipping options for a checkout session.

Request Body

{
  "shipping_address": {
    "first_name": "John",
    "last_name": "Doe",
    "address_1": "123 Main St",
    "city": "New York",
    "state": "NY",
    "postcode": "10001",
    "country": "US"
  }
}

Example Response

{
  "shipping_methods": [
    {
      "id": "flat_rate",
      "label": "Flat Rate",
      "cost": "10.00",
      "delivery_time": "3-5 business days"
    },
    {
      "id": "express",
      "label": "Express Shipping",
      "cost": "25.00",
      "delivery_time": "1-2 business days"
    }
  ]
}
POST /wp-json/acp/v1/checkout-sessions/{id}/complete

Finalize the checkout and create a WooCommerce order.

Request Body

{
  "payment_method": "stripe",
  "payment_intent_id": "pi_xyz123",
  "billing_address": {
    "first_name": "John",
    "last_name": "Doe",
    "address_1": "123 Main St",
    "city": "New York",
    "state": "NY",
    "postcode": "10001",
    "country": "US",
    "email": "customer@example.com",
    "phone": "+1234567890"
  },
  "shipping_method_id": "flat_rate"
}

Example Response

{
  "order_id": 456,
  "order_number": "456",
  "status": "processing",
  "total": "75.38",
  "customer": {...},
  "items": [...],
  "created_at": "2025-01-15T15:30:00Z"
}

Webhooks (Pro Only)

Webhooks allow your AI agent to receive real-time notifications when events occur in your WooCommerce store.

Supported Events

Event Description
order.created A new order has been created
order.updated An order status has been updated
order.completed An order has been marked as completed
order.cancelled An order has been cancelled
order.refunded A refund has been issued for an order

Webhook Payload

{
  "event": "order.created",
  "timestamp": "2025-01-15T15:30:00Z",
  "data": {
    "order_id": 456,
    "order_number": "456",
    "status": "processing",
    "total": "75.38",
    "customer": {
      "email": "customer@example.com",
      "first_name": "John",
      "last_name": "Doe"
    },
    "items": [...]
  }
}

Verifying Webhook Signatures

All webhooks include an HMAC signature in the X-WCP-Signature header. Always verify this signature to ensure the webhook came from HubACP.

Node.js Example
const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return signature === `sha256=${expectedSignature}`;
}

// In your webhook handler
app.post('/webhooks/wooacp', (req, res) => {
  const signature = req.headers['x-wcp-signature'];
  const payload = JSON.stringify(req.body);

  if (!verifyWebhook(payload, signature, signingSecret)) {
    return res.status(401).send('Invalid signature');
  }

  // Process webhook
  console.log('Received event:', req.body.event);
  res.status(200).send('OK');
});

Webhook Retry Policy

If your webhook endpoint returns a non-200 status code, HubACP will retry the webhook with exponential backoff:

  • Retry 1: After 1 minute
  • Retry 2: After 5 minutes
  • Retry 3: After 15 minutes
  • Retry 4: After 1 hour
  • Retry 5: After 6 hours (final attempt)

Security Best Practices

🔐 Security Checklist

  • ✅ Always use HTTPS in production
  • ✅ Store API keys and signing secrets securely (use environment variables)
  • ✅ Verify HMAC signatures on all webhooks
  • ✅ Use idempotency keys to prevent duplicate orders
  • ✅ Implement rate limiting on your webhook endpoints
  • ✅ Regularly rotate your API credentials
  • ✅ Monitor API usage for suspicious activity

Idempotency Keys

To prevent duplicate orders from network retries, include an idempotency key with checkout requests:

{
  "items": [...],
  "customer": {...},
  "idempotency_key": "unique-request-id-" + Date.now()
}

If the same idempotency key is used within 24 hours, HubACP will return the original response instead of creating a duplicate.

Code Examples

Complete Purchase Flow

JavaScript/TypeScript
const HubACPClient = require('hubacp-client');

const client = new HubACPClient({
  baseUrl: 'https://your-store.com',
  apiKey: process.env.HUBACP_API_KEY,
  signingSecret: process.env.HUBACP_SIGNING_SECRET
});

async function completePurchase() {
  // 1. Search for products
  const products = await client.products.list({
    search: 'laptop',
    per_page: 5
  });

  console.log(`Found ${products.pagination.total} laptops`);

  // 2. Create checkout session
  const session = await client.checkout.createSession({
    items: [
      { product_id: products.products[0].id, quantity: 1 }
    ],
    customer: {
      email: 'customer@example.com',
      first_name: 'John',
      last_name: 'Doe'
    },
    idempotency_key: `order-${Date.now()}`
  });

  console.log(`Session created: ${session.session_id}`);

  // 3. Calculate shipping
  const shipping = await client.checkout.calculateShipping(session.session_id, {
    shipping_address: {
      first_name: 'John',
      last_name: 'Doe',
      address_1: '123 Main St',
      city: 'New York',
      state: 'NY',
      postcode: '10001',
      country: 'US'
    }
  });

  console.log('Shipping options:', shipping.shipping_methods);

  // 4. Complete the order
  const order = await client.checkout.complete(session.session_id, {
    payment_method: 'stripe',
    payment_intent_id: 'pi_123abc',
    billing_address: { /* ... */ },
    shipping_method_id: shipping.shipping_methods[0].id
  });

  console.log(`Order created: #${order.order_number}`);
  return order;
}

Python Example

Python
from hubacp import HubACPClient
import os

client = HubACPClient(
    base_url='https://your-store.com',
    api_key=os.getenv('HUBACP_API_KEY'),
    signing_secret=os.getenv('HUBACP_SIGNING_SECRET')
)

# Search products
products = client.products.list(search='laptop', per_page=5)
print(f"Found {products['pagination']['total']} laptops")

# Create checkout session
session = client.checkout.create_session(
    items=[
        {'product_id': products['products'][0]['id'], 'quantity': 1}
    ],
    customer={
        'email': 'customer@example.com',
        'first_name': 'John',
        'last_name': 'Doe'
    },
    idempotency_key=f"order-{int(time.time())}"
)

# Complete order
order = client.checkout.complete(
    session['session_id'],
    payment_method='stripe',
    payment_intent_id='pi_123abc',
    billing_address={...},
    shipping_method_id='flat_rate'
)

print(f"Order created: #{order['order_number']}")

Troubleshooting

Common Issues

401 Unauthorized Error

Cause: Invalid API key or missing authentication header.

Solution: Verify your API key is correct and included in the X-WCP-API-Key header.

403 Forbidden - Invalid Signature

Cause: HMAC signature doesn't match the request body.

Solution: Ensure you're using the correct signing secret and computing the HMAC correctly. The signature must be generated from the exact request body string.

404 Product Not Found

Cause: Product ID doesn't exist or is not published.

Solution: Check the product exists in WooCommerce and is published. Only published products are available via the API.

422 Session Expired

Cause: Checkout session has expired (sessions expire after 1 hour).

Solution: Create a new checkout session. Don't store session IDs for long periods.

429 Rate Limit Exceeded

Cause: Too many requests in a short time period.

Solution: Implement exponential backoff and respect rate limit headers. Free plan: 60 requests/minute. Pro plan: 300 requests/minute.

Debug Mode

Enable debug mode in the HubACP settings to log all API requests and responses:

  1. Go to WooCommerce → Settings → HubACP
  2. Enable Debug Mode
  3. Check logs at WooCommerce → Status → Logs

⚠️ Warning: Debug mode can expose sensitive data. Only enable it temporarily for troubleshooting and disable it in production.

Frequently Asked Questions

What's the difference between Free and Pro?

The Free version provides read-only access to your product catalog. The Pro version unlocks the full checkout API, webhooks, unlimited site licenses, and priority support.

Can I use HubACP with any AI agent?

Yes! HubACP is AI-agnostic. Any system that can make HTTP requests can integrate with the API. We provide SDKs for popular languages to make integration easier.

How do I handle payments?

HubACP integrates with your existing WooCommerce payment gateways. Your AI agent should collect payment on its end (via Stripe, PayPal, etc.) and then pass the payment confirmation to the checkout completion endpoint.

Are webhooks guaranteed to be delivered?

We make a best effort to deliver webhooks with automatic retries. However, you should implement idempotency on your end and periodically poll for order status if webhook delivery is critical.

Can I test the API in a sandbox environment?

Yes, we recommend setting up a staging WooCommerce site for testing. You can generate separate API credentials for your staging and production environments.

What happens if I exceed the rate limit?

You'll receive a 429 status code with a Retry-After header indicating when you can retry. Implement exponential backoff to handle rate limits gracefully.

How do I upgrade from Free to Pro?

Purchase the Pro version, install it (it will override the free version), and activate with your license key. Your existing API credentials will continue to work.

Is HubACP compatible with my WooCommerce plugins?

HubACP works with standard WooCommerce functionality. Compatibility with third-party plugins depends on the plugin. Tax, shipping, and payment gateway plugins should work normally.

Need Help?

📧 Email Support

Pro customers get priority email support with 24-hour response time.

Contact Support

💬 Community Forum

Join our community forum to ask questions and share experiences.

Visit Forum

🐛 Report a Bug

Found a bug? Report it on GitHub and help us improve HubACP.

Report Issue