# WooCommerce

Abandoned checkout reminders, order confirmations, shipping updates and OTP codes for WordPress + WooCommerce stores.

## Connect {#connect}

Portal › Integrations › WooCommerce: enter the store address. Then either:

- **Automatic**: also paste REST API keys (WooCommerce › Settings › Advanced › REST API, permission Read/Write). We create the two webhooks for you. Keys are stored encrypted.
- **Manual**: without keys we show a delivery URL and a secret (once). In WooCommerce › Settings › Advanced › Webhooks add two webhooks, topics **Order created** and **Order updated**, API version WP REST API v3, with that URL and secret.

Every webhook is checked against `X-WC-Webhook-Signature` (base64 HMAC-SHA256 of the raw body with the secret). The test ping WooCommerce sends when a webhook is saved is answered with 200.

## Events {#events}

| Order status | Event |
| --- | --- |
| `pending`, `checkout-draft`, `failed` | Checkout not completed → abandoned checkout SMS after N minutes with the order's payment link |
| `processing`, `on-hold` | Order created |
| `completed` | Order shipped. Tracking from the *Shipment Tracking* plugin (`_wc_shipment_tracking_items`): link, else the tracking number |
| `cancelled`, `refunded` | Closes the checkout (no reminder) |

National numbers are read with the billing country. Same templates, variables, test mode and log as [Shopify](https://app.ogave.co/docs/integrations/shopify#events).

## OTP codes {#otp}

From your server (e.g. a login-by-SMS plugin), sign the JSON body with the store secret:

```
$body = json_encode(['phone' => '+573001234567']);
$sig = base64_encode(hash_hmac('sha256', $body, $secret, true));
POST https://app.ogave.co/integrations/woocommerce/otp/{connection}/start   (header X-Webhook-Signature: $sig)
POST https://app.ogave.co/integrations/woocommerce/otp/{connection}/check   {"verification_id": "ver_…", "code": "123456"}
```