Digi-Key vs WooCommerce

Digi-Key's api.digikey.com gateway runs a genuine OAuth2 flow: its authorization endpoint rejects requests missing a client_id, and resource endpoints additionally require a client-specific header, ruling out simple API-key auth. Access to product, ordering, and barcode data is free with per-product rate limits, and CORS is explicitly configured, echoing the request Origin on both live calls and OPTIONS preflights.

WooCommerce's REST API isn't a centrally hosted service — every self-hosted WooCommerce store exposes its own instance, authenticated by a consumer key/secret pair sent as HTTP Basic Auth credentials over HTTPS, per WooCommerce's own documentation. Because CORS support depends entirely on each merchant's own server configuration rather than the protocol itself, it can't be verified as a single blanket property of "the API." The protocol ships free with the open-source plugin; the only cost is whatever the merchant already pays to host their own store.