WooCommerce and AI agents: let assistants manage orders on your WordPress store

WooCommerce stores are about to get a new kind of visitor

WooCommerce runs a large share of the world's online stores. Their customers are starting to hand everyday tasks to AI assistants: "Where's my order?", "Cancel the blue one", "Return the shoes, they don't fit."

Those assistants need two things from your store: a way to find out how to talk to it, and a safe way to act for the customer. WooCommerce has neither out of the box. Its REST API is built for you and your developers, not for thousands of assistants acting for thousands of customers.

This guide shows how to add both in a few minutes, without touching your theme or your code.

Step 1: Connect your store in one click

In your Allowfy dashboard, open Setup → Your system, choose WooCommerce, enter your store address and press Connect automatically.

You're taken to your own WordPress dashboard, where WooCommerce asks you to approve Allowfy. Approve it, and WooCommerce gives Allowfy its key directly. You never copy or paste a secret.

Prefer to do it by hand? Create a key in WooCommerce → Settings → Advanced → REST API with Read/Write permission, and paste it into Allowfy.

Step 2: Install the Allowfy plugin

AI agents look for a business's capabilities at a standard address: /.well-known/poppy.json on its own domain. That's how an assistant learns that your store accepts agents, and where to send them.

The Allowfy for WooCommerce plugin serves that file on your domain:

1. Install and activate the plugin.
2. Open WooCommerce → Allowfy.
3. Paste the discovery address from Allowfy (Setup → How agents find you) and save.

Your store now answers at yourstore.com/.well-known/poppy.json. The plugin only accepts addresses on allowfy.com, so nobody can use it to send your customers' agents anywhere else. And if you remove the plugin, it cleans up after itself.

Step 3: Choose your rules

When you connect, Allowfy offers a recommended set of store rules:

• Reading orders and searching products: allowed.
• Cancelling and returns: the customer approves the exact terms in their assistant.
• Above 500: the customer approves, then your team reviews.

Add limits over time if you want them, such as no more than two returns per customer per week, across every assistant.

What your customers' assistants can do

• List the customer's orders and read any of them.
• Search your products.
• Ask to cancel an order.
• Ask to return an order.

Every request goes through your rules. Anything without a rule is refused.

How customers sign in

The assistant never asks for a password. The customer receives a one-time code by email, at the address of their account in your store, enters it on your page, and the assistant is connected to their account only. They can disconnect it at any time.

What happens behind the scenes

When a customer's assistant asks to return order 1042:

1. The assistant proves who it is with its own signing key.
2. Allowfy reads the order from WooCommerce and quotes the exact terms.
3. Your rules check the request, and the customer's totals for the week.
4. The customer approves those terms in their assistant.
5. Allowfy sends the return to WooCommerce once, even if the network fails halfway.
6. Every step lands on a signed record you can export.

Why not just let agents use the website?

They can try, but then you don't know who is acting, the customer may hand their password to an agent, nothing limits what it does, and nothing is recorded. A gateway gives you the orders that AI agents bring while keeping every decision yours.

Start in test mode

Create a free Allowfy account and connect your store in test mode: everything runs end to end, and nothing real changes in your store. When you're happy, go live.

Not sure where your site stands? Allowfy Check tests it for agent-readiness for free.