A remote product feed should not be an anonymous public export. It should identify both the credential and the website allowed to use it. PI Remote WooCommerce Product Display WordPress Plugin pairs each publishing API key with one approved display domain.
This domain-bound approach makes partner access explicit. If a key is copied to a different domain, the source store rejects the request because the supplied display domain no longer matches the allowed hostname.
Before generating a key
Confirm the following:
- The source website runs WooCommerce.
- The plugin role is Publish or Publish + Display.
- The product licence is active for the source domain.
- The display website hostname is known.
- Both production sites use HTTPS.
Use the real public hostname, such as partner.example.com. Do not enter a full page path. The plugin normalizes the hostname and treats www and non-www forms as the same domain.
Generate the publisher API key
On the WooCommerce source website:
- Open the plugin’s API Keys tab.
- Select Add API key.
- Enter a recognizable partner label.
- Enter the allowed display domain.
- Leave the key enabled.
- Choose Generate API Key.
The Issued API Keys table shows the partner label, allowed domain, Source API URL, credential status and actions. Copy both the generated key and the complete Source API URL. The REST endpoint follows this structure:
https://store.example.com/wp-json/pi-remote-product-suite/v1/productsThe display-site administrator needs both values.
How authorization works
The display plugin sends two request headers:
X-PI-Remote-Key: generated-key-value
X-PI-Remote-Domain: partner.example.comThe source site checks that the key is enabled, belongs to the active licence allowance and matches the approved domain. A missing or mismatched value returns an unauthorized response.
Avoid sharing API keys in public documentation, screenshots, support tickets or chat logs. Provide them through an appropriate private channel and treat them as credentials even though the endpoint exposes product data rather than customer orders.
Manage one key per partner domain
Do not reuse one key across several websites. Separate keys make it possible to disable one partner without interrupting the others. Labels also make the Issued API Keys table readable as the network grows.
The connection allowance depends on the licence tier:
- Standard can issue and consume up to 3 API connections.
- Business can issue and consume up to 10.
- Developer can issue and consume up to 20.
The allowance is the only tier-based feature difference; display, filtering, layout and caching capabilities remain available across tiers.
Regenerate, disable or delete?
Use Regenerate if a credential may have been exposed. The previous key stops working, so update the matching source on the display website immediately.
Disable a key when access should be paused but the partner record may be needed again. Delete it when the relationship has ended and the connection should be removed permanently.
Troubleshooting a rejected request
Check these items in order:
- The full Source API URL was copied without alteration.
- The API key has no missing or extra characters.
- The key is enabled.
- The allowed domain matches the display site hostname.
- The key falls within the active licence connection allowance.
- HTTPS and WordPress REST API access are available.
After correcting the publisher record, use the Test action on the display site’s Remote API tab. If an older error persists, clear the relevant display cache entry before testing again.
Learn more about secure partner catalogs and available connection tiers on the PI Remote WooCommerce Product Display product page.
