About this plugin
Building an SPA or mobile app on WooCommerce? Stop receiving 50+ fields when your screen needs 3 — and stop stitching together a JWT plugin, a filtering snippet, and a Stripe integration to get there.
ShopMobi is an all-in-one WooCommerce REST API layer for developers building single-page apps, Flutter apps, React Native apps, or any headless WooCommerce frontend. It ships two things:
- Field Filtering — trim the responses of the existing WooCommerce wc/v3 endpoints (products, variations, orders, customers). No new routes: you keep calling the standard WooCommerce REST API and opt into smaller responses.
- Custom Endpoints — ready-made routes under shopmobi/v1 for login, registration, password reset, store settings, and Stripe payments.
📖 Full API reference with every request, response and error code: GitHub documentation
At a Glance
Same endpoint, same credentials, one query parameter added:
fields=id,name,price
- Fields returned per product: 66 by default → only the ones you ask for
- Payload for one product: ~2.8 KB → ~130 B
- Payload for a 20-product listing screen: ~56 KB → ~2.5 KB
- New endpoints to learn: none — it’s the same wc/v3 route
Why ShopMobi?
- One plugin instead of three. A headless WooCommerce frontend usually needs a JWT/auth plugin, hand-written response-filtering code, and a separate Stripe integration. ShopMobi ships all of it as one tested package.
- Built for SPA and mobile clients. Flutter, React Native, and native apps pay for every extra byte in load time, memory, and mobile data. A product screen that needs 4 fields shouldn’t download 60+.
- GraphQL-like control without leaving REST. Pick exactly the fields you want, per request — no schema, no query language, no extra server.
- Auth, password reset, and Stripe included. Login, registration, profile updates, password reset, and Stripe PaymentIntent / EphemeralKey creation are ready to use, so you don’t build and secure them yourself.
Field Filtering
Add an include list or an exclude list to any supported wc/v3 request, as a header or a query parameter:
- Include only these fields: header X-WC-Fields: id,name,price or query?fields=id,name,price
- Exclude these fields: header X-WC-Except: meta_data or query?except_fields=meta_data
How it behaves:
- WooCommerce builds its normal response first — every hook, permission check, and sanitization rule still runs. ShopMobi only trims the top-level keys right before the response is sent.
- Collections (e.g. a product list) are trimmed item by item, so every item comes back in the same shape.
- If a header and a query parameter are both sent, the header wins. If an include and an exclude list are both sent, both apply.
- With an include list, only the listed fields come back — add id yourself if your app needs it.
Example — only the fields a product list screen needs:
fields=id,name,price,images" \ -u consumer_key:consumer_secret
Response (every product in the list is trimmed the same way):
jpg" }] } ]
Example — drop heavy fields from orders instead:
except_fields=meta_data,_links,tax_lines" \ -u consumer_key:consumer_secret
Supported endpoints: products, product variations, orders, order refunds, and customers (list and single-item routes).
Variation enhancement: product responses return full variation objects instead of raw variation IDs — pricing, sale status, SKU, stock, attributes, and image URL — so a product page doesn’t need one extra request per variation.
Custom Endpoints
com/wp-json/shopmobi/v1:
- POST /users/login — log in with username and password (cookie-based, rate limited)
- POST /users/register — create a customer account (rate limited)
- POST /users/update-profile — update name and phone (requires login)
- POST /users/reset-password/generate — email a password reset key
- POST /users/reset-password/verify — verify the key and set a new password
- GET /general-settings — store country, currency format, and active payment gateways
- GET /store-location — store address (requires login)
- GET /payment-gateways — active payment gateways
- POST /stripe-payment — create a Stripe PaymentIntent + EphemeralKey for Stripe’s mobile PaymentSheet (requires login)
Endpoints marked requires login need a valid WordPress session: cookie authentication with an X-WP-Nonce header, or Application Passwords over HTTP Basic Auth. /users/login sets standard WordPress auth cookies; it does not return a bearer token.
Request bodies, response examples, and error codes for every endpoint are in the GitHub documentation.
Third-Party Services
com) for payment processing. The Stripe integration is inactive until you provide API keys under WooCommerce > API Optimizer.
When the /shopmobi/v1/stripe-payment endpoint is called, payment data (amount, currency, Stripe customer ID) is sent directly to Stripe’s servers. No payment data passes through ShopMobi or any other third party.
- Stripe Privacy Policy: https://stripe.com/privacy
- Stripe Terms of Service: https://stripe.com/legal
Your Stripe API keys are stored in your WordPress database and are never shared with the plugin author.
Privacy
This plugin stores data in your own WordPress database only:
- Stripe customer IDs ( stripe_cust_id user meta) — created when a user makes a Stripe payment, and shared only with Stripe to identify returning customers.
- Password reset keys — handled entirely by WordPress core ( get_password_reset_key() / reset_password() ).
The plugin does not track users, send analytics, or transmit personal data to ShopMobi or any third party, except payment data sent directly to Stripe when the Stripe endpoint is used.