Hinata Connector for WooCommerce

Hinata Connector for WooCommerce is the companion plugin of the Hinata for WooCommerce app. Install it on the WooCommerce store you want to migrate, paste the token generated by the app, and the app can read your catalog, orders, customers, content and extension data.

What the plugin does:

• Authenticates the app with a single token (no WooCommerce API keys to create). Only the SHA-256 fingerprint of the token is stored.
• Answers the app’s REST calls as a dedicated shop_manager service user, even when a security extension blocks the REST API or when permalinks are set to “Plain”.
• Exposes a small discovery API (hinata/v1) so the app can list your tables, inspect the ones created by extensions and read them page by page, plus the meta keys used by products, variations, orders, customers and categories.

What the plugin never does:

• It never writes to your store: only its own options and the service user are created, and the token is refused on every write request (POST, PUT, PATCH, DELETE).
• It never initiates a transfer to an external service. Once you authorize the connection, it returns store data to the Hinata app in response to authenticated requests.
• It never exposes users, passwords, API keys, sessions, payment tokens, order tables or customer lookup tables through the discovery API, and it redacts sensitive columns and meta keys (passwords, hashes, tokens, API keys, order keys, IP addresses, user agents) in the tables it does expose.
• It never logs the token.

External service

This plugin connects your store to Hinata for WooCommerce, a separately hosted Shopify migration app. An installation of the app on your destination Shopify store is required. The plugin does not perform the migration itself; the app reads the source data and creates the corresponding resources using Shopify’s Admin API. The app may require payment for migration; installing this plugin does not purchase the service.

After you generate a token in the app and save it in this plugin, the app can request products, categories, customer names and contact details, order contents and addresses, pages, posts, and supported extension data for your migration. These responses leave your WordPress server and are processed by Hinata for transfer to your destination Shopify store. Activating the plugin alone does not start a migration. Remove the saved token or deactivate the plugin to revoke access.

The connection test makes a request to your own site’s REST API. The plugin does not include advertising or analytics tracking.

• Service: https://hinata-production-c585.up.railway.app/
• Terms of service: https://hinata-production-c585.up.railway.app/terms
• Privacy policy: https://hinata-production-c585.up.railway.app/privacy

1. In your WordPress admin, go to Plugins > Add New and search for “Hinata Connector for WooCommerce”.
2. Click “Install Now”, then “Activate”. WooCommerce must be active.
3. In the Hinata for WooCommerce app, enter your store address and generate the token.
4. Go to WooCommerce > Settings > Hinata, paste the token and save.
5. Click “Test connection” to check that the REST API is reachable.

You can also download the plugin ZIP from WordPress.org and install it from Plugins > Add New > Upload Plugin. For a manual installation, upload the hinata-connector-for-woocommerce folder to /wp-content/plugins/ and activate it.

If your site runs behind a load balancer or a CDN that terminates TLS, enable “Trust proxy headers” so that HTTPS is recognized.

Does the plugin modify my store?

No. It only stores its own settings and creates a service user (hinata-connector) used to answer the app’s calls. Uninstalling the plugin removes both.

Is HTTPS required?

Yes. Calls over plain HTTP are refused unless you explicitly allow them in the settings, which is not recommended.

Can I revoke the access?

Yes: check “Remove the stored token” in WooCommerce > Settings > Hinata, or deactivate the plugin.

1.6.1

• Read stored catalogue prices and standard WooCommerce tax rules independently of third-party pricing filters.
• Preserve extension callbacks and the storefront tax cache while reading migration evidence.

1.6.0

• Expose native WooCommerce product prices, sale prices and tax evidence for the catalogue price preview.
• Report store tax display, reference address and rounding settings without modifying customer tax context.

1.5.2

• Load settings scripts and styles through WordPress.
• Sanitize request metadata and reject malformed credential input.
• Align the text domain and contributor metadata with the directory submission.

1.5.1

• Meta discovery: each key now reports the length of its longest value beside the sample. The sample is cut at 200 characters, so a paragraph looked exactly like a line of text and the app proposed a short-text metafield for it.

1.5.0

• Brands: “info” now lists the taxonomies registered on products with their term counts, so the app can tell where the brands live — WooCommerce’s own taxonomy or the one a brand extension registered. Three read-only resources come with it: “taxonomies”, “terms” (name, slug, description, parent, term meta and the logo resolved to its address) and “term_objects” (the products of each term).

1.4.2

• Blog posts: the author embedded in a post (public profile only) is readable again, so posts keep their author’s name.

1.4.1

• Hardening: the routes refused to the token are now matched whatever their letter case.
• Multilingual stores: WPML and Polylang languages are read faster (a few direct queries instead of one per item) and category translations are read correctly, including under WPML; “translations” also reports the last modification of each original in its own language and ignores contents in the trash; “product_ids” refuses an unknown “lang” code instead of returning an empty list.

1.4.0

• Multilingual stores: “info” now reports the translation plugin (WPML or Polylang), the default language and the language list; a new read-only “translations” resource lists, for each original product, category, page or post, the ids and last modification of its translations; “product_ids” accepts a “lang” filter. TranslatePress, Weglot and GTranslate are detected and reported.

1.3.0

• New read-only “product_ids” resource: the ids of the products present in the database, so the app can spot the ones the WooCommerce REST API leaves out of its lists when the store’s lookup tables need rebuilding, and read them one by one.

1.2.2

• Hardening: the service account is only elevated on the REST front controller; payment gateway, webhook, user and plugin routes are refused to the token; key/value tables never return a value without its key; the WooCommerce log table is not readable; large meta scans are skipped.

1.2.1

• Consent keys: WooCommerce order attribution metas and keys no account affirms are no longer proposed.

1.2.0

• The accounts to migrate as customers are read from the orders: “customer_ids” pages the accounts that placed at least one order (buyers) and, separately, the customer accounts without any order (dormant); “info” and “audience” carry both counts.

1.1.0

• New read-only “audience” resource: the WordPress roles and the newsletter consent meta keys of the site, with account counts, so the app can offer lists instead of free text.

1.0.0

• First release.