woocommerce_credentials_rejected
The shop answered and rejected the credential, or the credential could not be used at all: the key is missing, the secret is missing, or the base address is not `https`. Authentication travels in the header over HTTPS, so a shop published in clear text would hand over both pieces on the first hop, which is why it is rejected before anything leaves.
| Code | Type | HTTP | Category |
|---|---|---|---|
woocommerce_credentials_rejected | invalid_request_error | 422 | Integration |
Cause
The shop answered and rejected the credential, or the credential could not be used at all: the key is missing, the secret is missing, or the base address is not https. Authentication travels in the header over HTTPS, so a shop published in clear text would hand over both pieces on the first hop, which is why it is rejected before anything leaves.
What to do
Look at the field named by error.param. For api_key or api_secret, generate a READ-permission key pair in WooCommerce and save both values in full — the secret is shown only once. For site_url, publish the shop over https and fix the base address. Not to be confused with store_url_not_allowed, which is about an unauthorised destination and is fixed on a different screen.