Headless eCommerce API for Developers – CoCart – WordPress plugin

Description

CoCart: Headless WooCommerce API for Developers

CoCart is a developer-first REST API to decouple WooCommerce on the frontend.

Build the modern and scalable storefront of your dreams with confidence independent of WordPress using frameworks like Astro, React, Vue, or Next.js, gaining complete control over your customers experience no matter what your store sells.

Why 1,000+ developers choose CoCart

🚀 Core cart functionality (FREE)
* ✅ Zero learning curve – Built on WooCommerce Data Stores with familiar hooks, ensuring broad plugin compatibility.
* 🔐 Session management – Cookie-less, database-stored sessions. Handle concurrent users without breaking a sweat.
* 🛒 Essential cart operations – Add, remove, update items and calculate totals in simple API calls.

💻 Developer experience that doesn’t suck
* 🔑 Authentication that makes sense – Email, username, or phone login. No admin API keys to juggle.
* 🌍 CORS just works – First-party CORS support means your frontend connects instantly, no configuration hell.
* 🧩 Extendable Callbacks – Add your own logic without writing new API routes.
* 📦 Bulk Cart Requests – Combine multiple API calls into one for better performance.
* 📊 Cart Insights – Monitor all cart sessions, including those nearing expiration or already expired.

🎯 WooCommerce compatibility, guaranteed
* 🛠 Native checkout support – Load any cart session into WooCommerce’s checkout. Your payment gateways work seamlessly.
* 🔎 Product search – Query by name, SKU, or ID — authenticated or not — with flexible filtering.
* 💸 Name Your Price support – Donation-based pricing with built-in flexibility.

Want more? Upgrade to CoCart Plus.

First time using CoCart? Check out the documentation and create a sandbox to try it out.

💬 Loved by developers worldwide

★★★★★

“An excellent plugin, which makes building a headless WooCommerce experience a breeze. Easy to use, nearly zero setup time.” – Harald Schneider

★★★★★

“This plugin works great out of the box for adding products to the cart via API. The code is solid and functionality is as expected, thanks Sebastien!” – Scott Bolinger, Creator of Holler Box

★★★★★

“This plugin saved me tons of work and it is working amazingly! The plugin author provides fast and high-quality support. Well done!” – @codenroll

💼 Need More Features? Upgrade to CoCart Plus

Additional features in CoCart Plus:

🎫 Coupon Management – Apply discounts, promo codes, and boost conversions.
🚢 Shipping Calculations – Real-time shipping rates and method selection.
💰 Cart Fees – Add handling fees, rush charges, or custom pricing logic.
🥪 Advanced Batch API – Process multiple cart operations in a single request for lightning speed.
🕒 Rate Limiting – Prevent API abuse and maintain high performance under load.

🔓 Ready to Go Fully Headless?

Join thousands of developers and agencies building with CoCart — the REST API that takes WooCommerce further.

👉 Upgrade to CoCart Plus and build the future of eCommerce today.

★★★★★

“Thanks for doing such great work with this! Works exactly as expected and CoCart seems to have a nice community around it. The founder seems really devoted and that’s one of the key things for a plugin like this to live on and get the right updates in the future. We just got ourselves the lifetime subscription.” – Mighty Group Agency

See our wall of love for more developer testimonials.

💜 Need Support?

We aim to provide regular support for the CoCart plugin via our Discord community server. Please understand that we do prioritize support for our paying customers.

👍 Add-ons to further enhance CoCart

We also have add-ons that extend CoCart to enhance your development and your customers’ shopping experience.

CoCart – CORS enables support for CORS to allow CoCart to work across multiple domains.
CoCart – Rate Limiting enables the rate limiting feature for CoCart Plus or higher.
CoCart – JWT Authentication allows you to authenticate via a simple JWT Token.

These add-ons of course come with support too.

For additional security, consider our API Security plugin that provides a firewall to block unknown outsiders, rate limit requests and protect data exposure – no configuration required.

⌨️ Join our growing community

On Discord, we have a community of developers, WordPress agencies, and shop owners building the fastest and best headless WooCommerce stores with CoCart.

Come and join our community

🧰 Developer Tools

CoCart Beta Tester allows you to easily update to pre-release versions of CoCart for testing and development purposes.
CoCart VSCode extension for Visual Studio Code adds snippets and autocompletion of functions, classes, and hooks.
CoCart Product Support Boilerplate provides a basic boilerplate for supporting different product types to add to the cart with validation including adding your own parameters.
CoCart Cart Callback Example provides you an example of registering a callback that can be triggered when updating the cart.

More information

Website.
Documentation
Subscribe to updates
Like, Follow and Star on Facebook, X/Twitter, Instagram and GitHub

💯 Credits

This plugin is developed and maintained by Sébastien Dumont.
Founder of CoCart Headless, LLC.

Contributors & Developers

You can help translate “CoCart” into your language.

INTERESTED IN DEVELOPMENT?

Browse the code on GitHub, or follow the CoCart development blog for the latest development updates. You can also follow @cocartapi on Twitter to stay up to date about everything happening with CoCart.

Please share your experience

We’d love to hear what you have to say. Share your experience and help others discover CoCart. It helps to keep the plugin going strong, and is greatly appreciated.

Installation

Minimum Requirements

WordPress v6.3
WooCommerce v7.0
PHP v7.4

Recommended Requirements

WordPress v6.3 or higher.
WooCommerce v9.0 or higher.
PHP v8.0 or higher.

Automatic installation

Automatic installation is the easiest option as WordPress handles the file transfers itself and you don’t need to leave your web browser. To do an automatic install of CoCart, log in to your WordPress dashboard, navigate to the Plugins menu and click Add New.

In the search field type “CoCart” and click Search Plugins. Once you’ve found the plugin you can view details about it such as the point release, rating, and description. Most importantly of course, you can install it by simply clicking “Install Now”.

Manual installation

The manual installation method involves downloading the plugin and uploading it to your web server via your favorite FTP application. The WordPress codex contains instructions on how to do this here.

Upgrading

It is recommended that anytime you want to update CoCart that you get familiar with what’s changed in the release.

CoCart publishes release notes via the changelog.

CoCart uses Semver practices. The summary of Semver versioning is as follows:

MAJOR version when you make incompatible API changes.
MINOR version when you add functionality in a backwards compatible manner.
PATCH version when you make backwards compatible bug fixes.

You can read more about the details of Semver at semver.org

FAQ

What does CoCart do?

CoCart provides a frontend API for WooCommerce, enabling headless eCommerce development. Instead of being locked into WordPress themes, you can build lightning-fast storefronts with modern frameworks like React, Vue, Next.js, or any technology you prefer.

Who should use CoCart?

Developers who are tired of working on slow performance WooCommerce storefronts and want the freedom to build with modern frameworks. Perfect for:
– Frontend developers building headless eCommerce stores
– Agencies creating high-performance client sites
– Mobile app developers needing eCommerce APIs
– Anyone wanting infinite customization

Are there any limitations?

CoCart is designed with developers in mind allowing for complete control to customize or add support for a plugin to work with CoCart. CoCart does its best to work out of the box but if there is a compatibility issue with a plugin that you would like to work with CoCart. We would be happy to hear about it.

What is the source of truth?

CoCart sources the WooCommerce’s Data Stores API and repeats most WooCommerce hooks to provide a wider array of support for most WooCommerce extensions out of the box.

Does CoCart work for multi-site network?

Yes. Just install CoCart and activate it on the sites you want to use CoCart.

Can I have WordPress running on one domain and my headless eCommerce on another domain?

Absolutely. That is what CoCart is mainly developed for. You just need to enable CORS. You can do that easily with the CORS add-on or you can manually enable it via the filters available in the documentation.

Will CoCart interfere with other plugins?

The majority of plugins are not REST API specific so it shouldn’t. However, while we allow the source of truth for compatibility, there may be a WooCommerce extension that returns data via an action hook that the REST API cannot understand during a specific action and may fail the response.

If that does happen, simply report the situation with as much detail as possible on our GitHub repository and we will try our best to find a solution.

How do I set up CoCart?

You will first need WooCommerce installed and set up to your configurations. Then install CoCart, activate and you’re ready to start using the REST API following the API Reference provided.

Please check the requirements listed in the installation section.

Why use CoCart if the WooCommerce API already exists?

The WooCommerce REST API is primarily for store management (orders, products, coupons, etc.) and is designed for authenticated admins/apps. It isn’t built for customer cart flows.

CoCart fills this gap. It’s specifically built for frontend cart handling where you want a seamless shopping experience that mimics traditional WooCommerce behavior but via API.

It’s optimized, extendable, and built for performance in decoupled setups.

Why use CoCart and not WooCommerce’s Store API?

To better answer this question in detail, please read our comparison article.

Can we support SSO?

CoCart itself doesn’t use cookie-based authentication — it supports Basic and JWT Authentication (via add-on), which are stateless and frontend-friendly. So when a user logs in through your headless site/app, they’re authenticated for API requests — including cart operations.

Can we call other WP APIs alongside CoCart?

Definitely. CoCart doesn’t block or replace any part of the WP or WC APIs — it works alongside them. Once authenticated, your headless site/app can access any available endpoint, whether from CoCart, WooCommerce, or custom APIs you’ve built.

Do I need to have coding skills to use CoCart?

Yes, CoCart is built for developers. If you can make HTTP requests and work with JSON responses, you’re ready to use CoCart.

Skill level needed:
– Basic understanding of REST APIs
– Experience with JavaScript, React, Vue, or your preferred frontend framework
– Familiarity with HTTP requests (GET, POST, etc.)

No WordPress development experience required! CoCart abstracts away WordPress complexity, giving you clean, predictable API responses.

Where can I find documentation for CoCart?

You can find the documentation here.

Can I change the formatting of values, add and change details to the responses?

You certainly can. There are over 200+ filters available to customize to your needs.

Why does CoCart use a custom session handler and table in the database?

If you’re familiar with WooCommerce, you may be wondering why using a custom session handler at all instead of the WooCommerce default session handler? A number of reasons but the ones that really matter are.

The default session handler only supports cookies.
The default session handler only saves changes at the end of the request in the shutdown hook.
The default session handler has no support for concurrent requests.
The default session handler does not support guest customers.
The default session handler does not store additional data that may be required to help you.
The default session handler does not allow support for POS capability.
More consistent with modern web.

Is “WooCommerce Shipping and Tax” plugin supported?

No. “WooCommerce Shipping and Tax” ignores any custom REST APIs from allowing the ability to calculate the taxes from TaxJar except for WooCommerce Blocks and JetPack. We don’t recommend it. However, TaxJar for WooCommerce plugin is supported.

Is “TaxJar for WooCommerce” plugin supported?

If you have “TaxJar for WooCommerce” v3.2.5 or above and CoCart v3.0 or above installed… then yes, it is supported.

Can I use any modern stack?

Yes, you can use your preferred tools and favorite modern technologies like Astro, NextJS, React, Vue, Ember and more giving you endless flexibility and customization.

Where can I report bugs?

Report bugs on the CoCart GitHub repository. You can also notify us via the Discord community server in the #bug-report channel – be sure to search the forum to confirm that the error has not already been reported.

CoCart is awesome! Can I contribute?

Yes, you can! Join in on our GitHub repository and follow the development blog to stay up-to-date with everything happening in the project.

Is CoCart translatable?

Yes! CoCart is deployed with full translation and localization support via the ‘cart-rest-api-for-woocommerce’ text-domain.

Where can I get help or talk other users about CoCart core?

If you get stuck, you can ask for help in the CoCart support forum or join the CoCart Community on Discord where you will find like minded developers who help each other out. If you are in need of priority support, it will be provided by purchasing CoCart Plus or a higher tier.

Where can I find out more about the additional features?

Find out all relevant features and pricing information over on the official site.

My question is not listed here. Where can I find more answers?

Check out Frequently Asked Questions for more.

Reviews

Mark July 18, 2023

Perfect for setting up a headless woocommerce backend

fomigo June 15, 2023

Very good plugin, it helped me to connect Laravel catalog (for PageSpeed Insights, you know) & Woocommerce cart/checkout processing. Brilliant!

alusion March 28, 2023 1 reply

Plugin works great. Docs are great. Road map is great.When store front is finished we’ll go PRO 😎

hschneider66 August 9, 2022 1 reply

An excellent plugin, which makes building a headless WooCommerce experience a breeze. Easy to use, nearly zero setup time.

jnz31 August 16, 2021

since woocommerce is not offering product/cart api, this tools fits right in. you can do everything with it, all via api calls: products, variations, cart, shipping, checkout. (you might need the paid version as well. i bought them, so not sure, what comes out of the box and what features all need the extra mile. but still: worth it!) and the support is fast, too, thanks to seb. love it.

inspiredagency June 25, 2021

Plugin is a life saver when working turning wordpress & woocommerce into a headless cms. Support is also great and responsive to help with any issues you may have

Read all 21 reviews

Contributors & Developers

“Headless eCommerce API for Developers – CoCart” is open source software. The following people have contributed to this plugin.

Translate “Headless eCommerce API for Developers – CoCart” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

📢 Only bug and security updates will be provided here on WordPress dot ORG. Any new major updates starting with v5.0 will be provided directly from us.

Also, to avoid getting the plugin removed from the WordPress directory, the trademark word “WooCommerce” has been removed as part of the plugin title.

Before: Headless WooCommerce Made Easy with CoCart
Now: Headless eCommerce API for Developers – CoCart

In your WordPress dashboard under “Plugins”, you will see it labeled as “CoCart API – Headless eCommerce API for Developers”, before “CoCart API – Headless WooCommerce Made Easy”.

v4.8.0 – 22nd September, 2025

What’s New?

Authentication: Enhanced login endpoint with improved permissions control via the new hooks mentioned below.

Improvements

Authentication: Removed priority order so our JWT Auth integration can run earlier in the process.
Authentication: Refactored get_ip_address for better trusted proxy support and better IP address detection with additional headers.
REST-API: Session handler now loads during the login endpoint operations.
Security: Item keys are now restricted to 32 characters maximum for better validation.
User Management: Refactored is_user_customer function to support additional user roles beyond just customers.

Developers

Logging: Added informational logs for IP address detection and proxy handling.
Introduced a new filter cocart_login_permission_callback allows additional authentication checks after basic authorization for the login endpoint.
Introduced a new filter cocart_login_secure_auth_methods determines which authentication methods should skip additional auth checks.
Introduced a new filter cocart_login_query_parameters allows plugins to add additional parameters to the login endpoint.
Introduced a new filter cocart_trusted_proxies allows adding trusted proxy IPs/CIDR for secure IP detection.
Introduced a new filter cocart_ip_headers allows customization of headers used for IP address detection.
Introduced a new hook cocart_login_permission_granted that triggers when login permission is granted for the login endpoint.

Compatibility

Tested with WooCommerce v10.2

v4.7.0 – 8th August, 2025

What’s New?

Authentication: Added support for authenticating via JSON request body with clear indication for the login endpoint (API v2 ONLY).

Improvements

Authentication: Internal refactor to return WP_Error consistently from permission checks.
REST API: Login (API v2 ONLY) Explicit added query params for username and password.

v4.6.4 – 6th August, 2025

Bug Fixes

REST API: Fixes both the product review and rating count.
Feature: Fixed “Load Cart from Session” from destroying sessions once loaded due to session improvements made in WC v10.

Improvements

Plugin: Ensure that dependent plugins can be installed/activated if the plugin is installed in a different folder name.
Feature: “Load Cart from Session” improved session data checking.
Session handler: Reduced duplicate session calls and optimized update_session_timestamp() database query.
Session handler: Restored persistent_cart_update compatibility for WooCommerce v10; only active for versions lower than v10.1.
Session handler: Overrode session_exists() and delete_session() to use CoCart’s session table.
Load Cart: Switched from $_REQUEST to $_GET and removed the priority for load_cart_action.
Load Cart: Re-enabled initialize_cart_session() and stopped destroying cookies when loading carts.

Deprecated

Action hook cocart_load_cart_override is no longer used.

v4.6.3 – 27th July, 2025

Bug Fix

REST API: Fixes identifying namespace and routes in the WordPress REST API Index if not set should they already be filtered out.

v4.6.2 – 25th July, 2025

Bug Fix

REST API: Removing an item stays removed. Solves issue #534

WooCommerce v10 caused a cache issue due to a change in the many times session data is handled.

Improvements

Plugin: Session handler optimized – New sessions created first, then auth users if no cart requested.
Plugin: Session handler – Removed the need to set cart hash at the start.
Plugin: Session handler – Added a warning log for when the session data must have really screwed up.
Plugin: Session handler – Added max expiration exceed limit to 30 days to avoid performance issues and the session table growing too large.
REST API: Check REST request is CoCart before maybe loading cart or filtering served requests.
REST API: Fixed deprecated functions still called in Products API.
REST API: Authentication and CORS optimized to parse data less allowing for a faster response.
REST API: Moved global headers to be filtered in rest_pre_serve_request instead of CoCart_Response which is not used for Products API.
Plugin: Moved the cart cache to load once WooCommerce has loaded instead of only during the REST API.

Developer note: Cart cache allows for items with custom pricing to be calculated on the native site and not just via the REST API to keep consistent with calculations.

Requirements

WooCommerce v9 minimum is now required for CoCart but for best performance recommend using v10+

Compatibility

Tested with WooCommerce v10.0.4

v4.6.1 – 21st July, 2025

Bug Fixes

REST API: Fixed undefined array key errors with cart session when cart is empty. Solves Issue #533
REST API: Fixed removing an item using the update endpoint when it thinks quantity value is not numeric.

Compatibility

Tested with WooCommerce v10.0.3

v4.6.0 – 26th June, 2025

This release is a compatibility release for the next WooCommerce release.

What’s new?

WordPress dot ORG: Added a Playground blueprint.

Changes

Plugin: Branding for CoCart has been updated.
Plugin: Styling for CoCart pages have been improved and more consistent on all pages by reducing conflicts with WordPress and WooCommerce styling.

Improvements

REST API: Basic authentication is detected much better.
REST API: Authentication failures now has debug logs.
WordPress Dashboard: Semantic markup overhaul for better screen reader interpretation.
WordPress Dashboard: Setup wizard and Support pages have been updated.

Compatibility

Tested with WooCommerce v10.0

v4.5.0 – 31st May, 2025

This release will most likely be the last update released on the WordPress plugin directory with anything NEW added.

What’s New?

REST API: Products can now be filtered to return only products by brand names.

Bug Fix

REST API: Added missing option for allowing to order products by random. Solves issue #516

Plugin Details

Plugin: Updated links for documentation.
WordPress Dashboard: Updated link for upgrade page.
WordPress Dashboard: Plugin action links are added after now, not before.

Compatibility

Tested with WooCommerce v9.9

v4.4.0 – 16th May, 2025

This release focuses on supporting such tools like ManageWP, MainWP, Blogvault etc.

Changes

WordPress Dashboard: Database updates now run automatically if needed. Resolves issue #511
WordPress Dashboard: Sessions now transfer automatically for new installs.
Session: Cart session expiration’s are now matching the default expiration WooCommerce set for better compatibility and abandoned cart support.
Session: Cart session expiration for logged in users renew daily and expire in a week. This is to keep carts persistent for logged in users.

Note: The session expiration’s can still be filtered back to the previous values but that would mean it would match the expiration for logged in users.

Third Party Support

Plugin: LiteSpeed Cache will now exclude CoCart from being cached. Commit

Developers

Filter cocart_cart_expiring added parameter is_user_logged_in() to allow the expiration for logged in users to be filtered.
Filter cocart_cart_expiration added parameter is_user_logged_in() to allow the expiration for logged in users to be filtered.

Internal

Improved the logger. Commit
Added logs for database update procedure. Commit

Deprecations

Filter cocart_log_entry_name no longer used.
Filter cocart_log_entry_version no longer used.
Filter cocart_log_entry_source no longer used.
Filter cocart_setup_wizard_store_save_next_step_override no longer used.

v4.3.30 – 27th April, 2025

Bug Fix

WordPress Dashboard: Fix plugin update warning for core plugin. Solves issue #506

Improvement

REST API: Variation attribute data is now sanitized. Labels are converted to names (e.g. Size to pa_size), and values are cleaned.

Compatibility

Tested with WordPress v6.8

v4.3.29 – 10th April, 2025

Bug Fix

REST API: Package details would not return but showed fine in shipping meta.

Improvements

REST API: Optimized fetching the cart in all Cart API endpoints.
REST API: Shipping now fully respects the shipping settings.

Dev note: Meaning if you have requested that the customer provides the shipping address first before shipping is calculated, then no shipping methods will return until it’s provided.

Compatibility

Tested with WooCommerce v9.8

v4.3.28 – 6th April, 2025

Bug Fix

REST API: Fixed unidentified item key when adding grouped products.

v4.3.27 – 3rd April, 2025

Bug Fix

REST API: Undone a change to fix any WooCommerce cookies from setting with the Cart API. Related to fixing persistent cart back in November last year.

v4.3.26 – 1st April, 2025

Bug Fix

REST API: Fixed critical error when adding an item and asking to return the item details. Solves issue #509

Improvements

REST API: Corrected and added missing schema information for Cart API v1.
WordPress Dashboard: Tweaked plugin screen modal for listing untested plugins.

Requirement change

WordPress 6.3 is the new minimum version required.

v4.3.25 – 17th March, 2025

Bug Fixes

Plugin: Failed to activate fully when network activated due to how admin notices where set. – Bug Report
WordPress Dashboard: Plugin suggestions was not letting you press the “Install Now” button.

v4.3.24 – 10th March, 2025

Bug Fix

Fixed a few typo’s in the session handler.

Improvements

WordPress Dashboard: Improved detection of a suggested plugin hosted on WordPress dot ORG and from a third party.
WP-CLI: Update command now asks for confirmation before proceeding.

v4.3.23 – 3rd March, 2025

Bug Fixes

Authentication: Changed access for setting an authentication error from protected to public. Allowing other authenticators to not fail when an error does occur.
WP-CLI: When updating the plugin, we don’t need to include the install class again.

Improvements

Database: Simply modified the structure for columns that were BIGINT UNSIGNED to bigint(20) unsigned.
Session handler: Guest carts will now have a prefix t_ before the cart key provided. This matches with WooCommerce session handler where it maybe used by 3rd party plugins or web host configurations to identify if the session is for a guest user.

Dev note: This affects only new guest sessions.

Compatibility

Tested with WooCommerce v9.7

v4.3.22 – 26th February, 2025

Corrections

REST API: Schema corrections for cart endpoint.
REST API: Schema corrections for items endpoint to match cart schema.

For Developers

Moved filter cocart_get_customer_{field} after value instead of using it only when there is no value returned for a customers field. Replace {field} with the section prefix followed by the field name. e.g. billing_country

Developer note: This allows you to then alter values such as the billing country. See example.

add_filter( 'cocart_get_customer_billing_country', function( $value ) { if ( WC()->countries->country_exists( $value ) ) { return WC()->countries->get_countries()[ $value ]; } return $value; }, 10, 1);

Introduced new filter cocart_get_after_customer_{field-type}_fields that allows you to change the customer fields after they returned. Replace {field-type} with either billing or shipping for the fields to alter.

v4.3.21 – 20th February, 2025

Improvement

REST API: Added no-store as part of the Cache-Control header for guest users.

v4.3.20 – 8th February, 2025

Bug Fix

REST API: Fixed product reviews not returning.

v4.3.19 – 6th February, 2025

Bug Fix

REST API: Fixed setting a customers shipping address line 1 and 2.

v4.3.18 – 22nd January, 2025

General

Updated link to Next Changelog for coming future major release. (v5.0)
Improved SASS to CSS conversion.

Compatibility

Tested with WooCommerce v9.6

v4.3.17 – 14th January, 2025

Bug Fix

REST API: Stock status was incorrectly queried for Products API and now checks available stock statuses before filtering.

Improvements

REST API: Version of CoCart only returns in the returned headers when debug is enabled now.
REST API: WP_DEBUG is made sure it is defined before returning extras for developers in the store response.

Compatibility

Tested with WooCommerce v9.5

View the full changelog here.