API keys let another site you own read what WP Conversion Tracker knows about a customer. A membership site's admin screen is a typical use. The keys are read only, so nothing about your tracking, links or Dashboard can be changed through them.
What A Site Can Ask:
Given a buyer's email address, the site receives every conversion recorded for that email, with the product, amount, gateway, refund state and the link it came through, plus totals. Two addresses on your site answer these requests:
- /wp-json/wct/v1/customer?email=... returns the conversions for one email. An optional limit sets how many are returned, up to 500.
- /wp-json/wct/v1/stats returns overall stats.
The caller sends its key in the X-WCT-Key header. With the Audience Vault add on installed, a third address, /wp-json/wct-av/v1/profile?email=..., returns that person's Vault profile using the same key, without private notes.
Creating A Key:
- Open the Settings tab and find the 🔌 API keys card.
- Type a label, for example the name of the site that will use it, and click Create a key.
- Copy the key straight away. It is shown once, it is stored hashed, and it cannot be shown again. If you lose it, create another.
- Paste it into the other site. In ResultsAiX Membership that is Integrations, then Other sites.
Managing Keys:
The card lists each key with its label, a short hint, when it was created and when it was last used. Click Revoke and any site using that key stops getting answers immediately.
Limits And Requirements:
Requests are limited to 120 a minute for each IP address, and a request with a missing or invalid key is refused. API keys need WP Conversion Tracker 3.568 or later.