If Link My Books can’t connect to your WooCommerce store — or the connection keeps dropping on its own — the cause is almost always security software on your website or hosting blocking our requests. This article shows you how to find it and clear it.
First: the error message is misleading
You’ll usually see one of these:
Invalid WooCommerce API credentials. Access deniedOops, failed to check accessFailed to connect to sales channelOr the store connects, then disconnects by itself days later
All of these can appear when your API keys are perfectly valid. They’re what we show when our request is blocked before it ever reaches WooCommerce — from the outside, a blocked request and a rejected key look identical to us.
🛑 Don’t start by regenerating your API keys
If your keys worked when you created them, they are almost certainly still fine. Regenerating them is the most common wasted step on these issues, and it won’t clear a block.
“It worked for months, then stopped”
Security software doesn’t have to be newly installed to start blocking us. A site redesign, a hosting provider enabling protection by default, a plugin update, or a change to bot-detection rules can all begin blocking a connection that had been fine for a year. Nothing needs to have changed on your side.
“I checked my server logs — Link My Books never made a request”
If your access logs show nothing from us, that is the strongest single clue that something is blocking us — not evidence that we aren’t calling you.
Cloudflare, and protection built into hosting such as StackProtect, SiteGround Security or Imunify360, all run at the edge, in front of your web server. When they block a request it never reaches your server, so it never reaches your logs. Empty logs are consistent with a block.
Our IP addresses
Link My Books calls your store from four outbound addresses. Allow all four:
35.206.139.10635.210.47.14835.210.208.11735.210.128.61
⚠️ Allowing only one of them is a common reason the fix doesn’t work
Also note that 198.202.211.1 is our public website, not the address we call your store from. Allowing that one will not help.
Better than allowing IPs: allow the API path
Blocks are often applied to the web address being requested rather than to the sender, which is why allowlisting our IPs alone sometimes doesn’t clear it. The most reliable fix is to exempt the WooCommerce API path:
/wp-json/wc/v3/
This only exposes the WooCommerce REST API, which still requires your API keys — so excluding it from bot challenges doesn’t open your site up.
If you use Cloudflare
1. Bot Fight Mode — check this first
Go to Security → Bots and look for Bot Fight Mode or Super Bot Fight Mode.
🛑 An IP allow rule will not get us past Bot Fight Mode
Cloudflare challenges bot traffic before it evaluates your allow rules. If Bot Fight Mode is on, switch it off and retry the connection. This has been the actual fix in cases where the customer had already allowlisted our IP addresses correctly.
If you need Bot Fight Mode on for the rest of your site, use the custom rule in step 3 instead — it skips bot protection for the API path only.
2. Allow our IP addresses
Go to Security → WAF → Tools → IP Access Rules. Add each of the four addresses above with the action set to Allow and the scope set to This Website.
3. Add a WAF custom rule (recommended)
Go to Security → WAF → Custom Rules → Create Rule.
Name it
Allow Link My Books APICondition: URI Path · contains ·
/wp-json/wc/Action: Skip — then tick Bot Fight Mode / Super Bot Fight Mode, and all remaining custom rules
Click Deploy
While you’re there it’s also worth checking Security → Settings for a high Security Level, and any Managed Rules or Browser Integrity Check.
If you don’t use Cloudflare
The same block commonly comes from one of two places.
WordPress security plugins
Wordfence, Solid Security (formerly iThemes Security), All-In-One Security (AIOS), WP Hide & Security Enhancer, Disable REST API — or anything with “Security” or “Firewall” in the name. In the plugin’s settings, look for Disable REST API, Block API access or Protect REST API, and either turn it off or add an exception for /wp-json/wc/.
Hosting-level protection
StackProtect, SiteGround Security, Imunify360, or your host’s own firewall. You usually can’t see or change these yourself, so send your hosting provider this:
We use Link My Books, which connects to our WooCommerce REST API. Please exclude the path /wp-json/wc/v3/ from any firewall, bot protection or security scanning, and allow these IP addresses: 35.206.139.106, 35.210.47.148, 35.210.208.117, 35.210.128.61.
Please also confirm the server is not stripping the Authorization header from incoming HTTP requests, as that header is required for API authentication.
A quick check you can run yourself
Open this in your browser, using your own store’s domain:
https://yourstore.com/wp-json/wc/v3/
You should see a short error message mentioning woocommerce_rest_cannot_view. That’s the correct response — it means the API exists and is answering.
If instead you get a Cloudflare “Just a moment…” page, a security product’s block page, or a 403 or 404 error page, your security setup is interfering with the WooCommerce API.
⚠️ Passing this test doesn’t prove we can reach you
You’re browsing from your own connection, and the block usually targets ours specifically. A pass only rules out the API being switched off altogether.
If you’re setting up a new connection
Check your keys in WooCommerce → Settings → Advanced → REST API:
The key must belong to a user with the Administrator or Shop Manager role
Permissions must be set to Read/Write
Your Consumer Key starts with
ck_and your Consumer Secret starts withcs_Enter your store’s root URL exactly as your site resolves. If your site is
https://www.yourstore.com, don’t enterhttps://yourstore.com/— a mismatch creates a second, separate sales channel instead of fixing the first.
Still stuck? Here’s what to send us
Please stop retrying first
Repeated failed attempts create duplicate inactive channels, and can make bot protection more aggressive rather than less.
Send us:
Your store URL, exactly as you entered it
Which steps above you’ve tried — especially whether Bot Fight Mode is on or off
Who manages your hosting or Cloudflare, if it isn’t you
Roughly when the connection last worked
If Cloudflare or your hosting is managed by a web developer, forwarding them this article directly is usually the fastest route to getting it cleared.