WP Manifestindependent plugin directory
manifest / ecommerce / headless-commerce-wordpress

1Ecomm Headless Commerce

WordPress plugin for 1ecomm headless commerce: shortcodes and blocks that render a live 1ecomm catalog and cart inside any WordPress site.

by phessage · github.com/phessage/headless-commerce-wordpress · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/phessage/headless-commerce-wordpress/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/phessage/headless-commerce-wordpress ↗

1Ecomm Headless Commerce for WordPress

Part of 1Ecomm headless commerce — catalog, cart, checkout and order APIs for custom storefronts and apps. Fastest start: npm create @1ecomm/storefront@latest · CLI guide · OpenAPI contract · All starters and SDKs

Free for authorized 1Ecomm customers and their developers to build and operate 1Ecomm-connected stores. You may deploy the finished store, but may not redistribute, resell, sublicense, mirror, or republish this plugin or a reusable derivative. See LICENSE.md.

This plugin lets a WordPress page sell products from a 1Ecomm store. It renders products, cart, guest checkout choices, a pending non-hosted order confirmation, and account-free return-order lookup on the server. It never charges a card or wallet.

Set it up

  1. Install and activate the onecomm-headless plugin.
  2. Save your 1Ecomm store ID in the onecomm_store_id setting. A store ID is an identifier, not a password.
  3. Add [onecomm_storefront] to a page.
  4. Open the page. No API URL or publishable-key copy is required.

For a clean local WordPress proof:

docker compose up -d
./tests/docker-smoke.sh

Run php tests/run.php for contract/security tests. In the WordPress CLI container, wp eval-file wp-content/plugins/onecomm-headless/tests/live.php creates an isolated fixture cart and pending bank-transfer test order. A real page can be driven with WORDPRESS_LIVE_URL=http://localhost:8180/?page_id=<id> npm run test:e2e:live. These tests do not move money, and demos must never clone production customer data.

CI now provisions a fresh WordPress runtime and an expiring 1Ecomm fixture for every run, executes the deployed catalog-to-order journey inside WordPress, and always revokes the temporary key and removes the containers. A missing allocator secret fails the gate instead of skipping it.

The cart token and short-lived order-lookup session stay in HttpOnly, SameSite=Lax cookies. Browser changes use a fixed nonce-protected WordPress action, so the checkout email is posted to WordPress and is not placed in the page URL. The order intent is retained server-side across uncertainty. Never enter an administrator password or secret API key. Customer-cart merge and direct payment capture remain outside this preview.

Signed event receivers

Server integrations pass the exact REST request body and headers to Phessage\OneComm\WebhookVerifier::verify. Keep the whsec_ value outside themes and browser code. Supply a replay-claim callback backed by a database unique constraint on delivery ID, then dispatch WordPress actions only after verification and the atomic claim succeed. The helper rejects stale timestamps, changed bytes, header/body ID mismatches and duplicate deliveries.