Integrations and the open edge

Connect Shopify or WooCommerce and browse products, orders, customers and trading live in AxisIQ, plus the WordPress plugin inventory WooCommerce hides.

Part of AxisIQ's single business model — The connection layer (Run the business). How the layers fit.

AxisIQ stays open at its edges. You can connect a Shopify or WooCommerce store and browse it live inside your workspace, call any HTTPS service from an automation, publish your own endpoints for anything that pushes data in, and drive the whole system through an API where every key carries its own permissions.

An integration here is a named connection with its own credentials and its own permissions — not a background sync nobody can read or change.

Connecting a store

You connect a Shopify or WooCommerce store with its own credentials, and AxisIQ proves them against the live store before saving anything. A store that refuses is an error while you are standing there, not a mystery two weeks later.

Credentials are sealed with AES-256-GCM before storage and never come back out — not to a screen, not to an export, not to an API response. Editing re-checks the same way: leave a secret blank to keep the one already held, and a change the store rejects is never written. "Saved" and "works" stay the same state.

The store, live, inside your workspace

A connection is somewhere to look, not just a saved secret. Open a store and you get an Overview — profile, health, endpoint, currency — then the collections it actually has.

Each is read on request, from the live store, a page at a time. Nothing is copied into AxisIQ, so there is no second copy drifting out of date and no "last synced six hours ago" under the numbers. A row opens onto the store's own untouched data plus a deep link into its admin — browsing is read-only, so any change hands off to the system that owns it.

Search and sort belong to the store, not the screen. WooCommerce can search and sort its collections; Shopify's list endpoints search customers only and take no sort order at all. Where the store cannot do it, the control is absent rather than filtering the rows already on screen and calling that a search.

How the store is trading

Pick 7, 30 or 90 days and you get that store's trading in one shape: headline numbers, a revenue and orders series, labelled breakdowns such as payment mix or order status, and best sellers where the store reports them.

The two platforms answer very differently, and the page does not hide it. WooCommerce has its own reports API, so the figures are the store's own and it decides whether the chart buckets by day or by month. Shopify's admin API publishes no reports endpoint at all, so its summary is added up here from one page of recent orders — at most 250, newest first — and the page says so rather than dressing a derived number up as official. Each breakdown is titled by what it genuinely covers, because "payment mix over 30 days" and "payment mix, all time" are different claims.

That is the store's trading, not your books — for questions across your own records, see Analytics.

The half of a WooCommerce store the commerce API never shows

A WooCommerce store is a WordPress install. Its plugins decide what that site can be made to do, and they are exactly what the order data cannot show you. AxisIQ lists them in one read — active and inactive, installed version beside the latest release — so searching it really does search every plugin.

AxisIQ does not match plugins against vulnerability advisories. It shows what is installed and what is out of date — the inventory any security review starts from.

There is a walk-through in the WooCommerce plugin security guide.

Sync is something you own

The honest limit: there is no background sync engine. Nothing quietly pulls orders in or pushes stock out on a schedule you did not write.

Instead, your flows and functions reach the store through a scoped connection — confined to that platform's API, with credentials injected on the server, so your code never holds the keys. "Pull yesterday's orders every fifteen minutes" becomes a few dozen readable lines on a schedule, under a named identity, with a run history you can inspect.

Writes to the store go the same way, deliberately: a fixed sync engine does most of what a business needs, and the part it misses is where that business lives.

Calling anything else, and being called

Not every integration is a store. A flow can make an outbound HTTP request to any service with an HTTPS API and use the reply in the next step. Requests aimed at private or loopback addresses are refused, so a flow cannot be turned back on the machine running it. A non-2xx reply is data, not a disaster.

Inbound is the mirror image. Any function can be published at a public URL — a payment gateway's webhook, a courier's status callback — with no separate server to run and patch. Those endpoints run under an anonymous identity whose permissions you define: grant nothing and the endpoint is pure computation, grant one narrow write and it creates exactly the record it should.

Ad platforms and messaging providers

Meta Ads and Klaviyo connect with an access token (a Meta system-user token or a Klaviyo private API key); other ad platforms cannot be connected. Campaigns and daily spend are copied into your workspace so spend, CTR and ROAS sit next to your own records, and campaigns can be paused, resumed or re-budgeted from AxisIQ.

Outbound email, SMS and WhatsApp go through the provider accounts your company already has — SES, SendGrid, Mailgun, Postmark, Resend, SMTP, Twilio, MSG91 and Meta's WhatsApp Cloud API — with delivery tracking and a suppression list that every sender respects. Messages and broadcasts can be scheduled for later, and still go through the same checks when they go out.

Keys that live inside the permission system

The dashboard runs on the same JSON API you get, with no private channel reserved for our own screens. Programmatic access uses API keys bound to a service account, an identity that sits in your permission groups as a person does. A key does what its grants allow, on its own organisation only.

Hand an integration to an agency or contractor and it is genuinely bounded: read products and write shipments, no path to cost prices or payouts. Revoking it is one action, and the audit trail still shows what it did.

Plenty of moves need no integration: every record type imports and exports CSV, up to 500 rows per imported file.

What is not here yet

Straight about the gaps: no one-click marketplace sync, no OAuth store install (you paste credentials), no storefront. Store browsing is read-only on purpose, and there is no Shopify plugin inventory — its apps are not exposed the way WordPress plugins are, and inventing one would be worse than showing nothing.

Whatever you pull in becomes ordinary records, so search, permissions and reports apply to it with no further wiring — Operations covers what those records are.

FAQ

Does AxisIQ work with WooCommerce? Yes. Connect a store with REST keys over https and you can browse products, orders, customers, discounts, categories and the plugin inventory live, plus a trading summary built from WooCommerce's own reports.

Can I connect a Shopify store to AxisIQ? Yes, with a custom app access token and your store domain, checked against the live store before it is saved. Products, orders, customers, discounts, draft orders and collections are all browsable.

Does AxisIQ sync my store automatically? No, deliberately. Browsing reads the live store without copying it, and any sync you want is a scheduled flow you write, running through a connection scoped to that store's API.

Can AxisIQ tell me if my WooCommerce plugins have known vulnerabilities? Not directly. It lists every installed plugin, active or inactive, with its installed and latest version, which shows what is out of date. Checking those versions against vulnerability advisories is a job for a dedicated security service.

Can I connect AxisIQ to a system it has no built-in integration for? Yes, in both directions: a flow calls any HTTPS API outbound, and a public function URL receives whatever needs to push data in.