How to Connect Any External Service to WordPress
You can connect any external API to WordPress in three ways: send data out using an HTTP request action, receive data in using a webhook listener, or write custom PHP using WordPress’s HTTP API. For most WordPress sites in 2026, the no-code route handles 90% of real integration needs, and Krom Automation covers both outbound and inbound without touching a line of code.
The gap that every other guide skips is what happens when the external service fails, rate-limits you, or returns unexpected data. We cover that too.
This guide is organised around the decision you are actually making: which method fits your situation, what each one costs in setup time, and where each one breaks under pressure. A developer reading this will find the honest constraints. A site owner reading this will find the path that does not require one.
Before choosing a method, it helps to understand how triggers, actions, and workflows connect in Krom Automation, since both HTTP requests and webhook receivers are built on that same foundation.
Browse the full feature list for Krom Automation to see every outbound action and integration available before you decide which path to take.
The Three Methods, and Which One You Actually Need
Most integration guides present every method as equally valid. They are not. The right method depends on who initiates the communication: your WordPress site, the external service, or both.
- Outbound HTTP request: WordPress sends data to an external API. Use this when something happens on your site, such as a form submission or order completion, and you want to notify or update an external service.
- Inbound webhook: An external service sends data to WordPress. Use this when the event originates outside WordPress, such as a payment processor confirming a charge or a form tool on a separate domain submitting an entry.
- Custom PHP (wp_remote_get / wp_remote_post): A developer writes the logic directly. Use this only when the two no-code methods genuinely cannot cover the requirement, which is rarer than most tutorials imply.
The table below maps situation to method so you can find your answer in under 30 seconds.
| Your situation | Right method | Setup time |
|---|---|---|
| User registers on your site, you want to add them to Mailchimp | Outbound HTTP request or native integration | 5 to 10 minutes |
| WooCommerce order completes, you want to create a row in Google Sheets | Outbound HTTP request or native integration | 10 to 15 minutes |
| Stripe payment confirmed, you want to enrol a user in a course | Inbound webhook | 15 to 20 minutes |
| External CRM updates a contact, you want to update a WordPress user meta field | Inbound webhook | 15 to 20 minutes |
| Deeply custom logic with conditional API chains and proprietary auth flows | Custom PHP | Hours to days, plus ongoing maintenance |
Outbound: Sending WordPress Data to an External API
The HTTP Request action in Krom Automation’s free version supports GET, POST, PUT, PATCH, and DELETE. It includes JSON response parsing, so you can read the response back and use values from it in later steps of the same workflow. That covers the majority of REST API integrations without writing a single line of code.
The setup for a typical outbound call takes five steps and runs in under 10 minutes the first time.
- Choose a trigger: the event on your WordPress site that starts the workflow. Examples include a WPForms submission, a new user registration, or a WooCommerce order completing.
- Add the HTTP Request action to the canvas.
- Set the method (POST for most APIs that accept data), the endpoint URL, and any required headers such as
Authorization: Bearer YOUR_KEY. - Map fields from the trigger to the request body using merge tags. A user’s email address, order total, or form field value drops in as a dynamic variable.
- Use the workflow simulator to run a dry test with zero side effects before activating.
The free actions reference documents every field the HTTP Request action accepts, including how to set custom headers, pass bearer tokens, and parse the JSON response for use in downstream steps.
A workflow that runs once correctly is worth more than a script that runs daily but nobody notices when it silently fails.
For services with a native integration already built, the HTTP Request action is the fallback, not the first choice. Krom Automation Pro includes 24 integrations covering email marketing tools like Mailchimp, ConvertKit, and MailerLite; CRM tools like ActiveCampaign and FluentCRM; and productivity tools like Google Sheets and Google Calendar.
When a native integration exists, use it. It handles authentication and field mapping for you and is less likely to break when the API updates its schema.
Authentication: API Keys, Bearer Tokens, and OAuth
Authentication is where most outbound integrations fail on the first attempt. Every API has one of three patterns, and confusing them costs 30 minutes of debugging.
- API key in header: The API gives you a static key. You add it as a custom header, typically
X-Api-Key: yourkeyorAuthorization: Bearer yourkey. This is the most common pattern for developer-facing REST APIs. - Basic auth: A username and password encoded in base64 and sent as
Authorization: Basic encodedstring. Still used by older APIs and some internal tools. - OAuth 2.0: Requires a token exchange step before making the actual request. Most OAuth flows are too complex for a generic HTTP action without a dedicated integration. If a native integration exists for that service, use it. If not, you need a developer or an intermediary like a self-hosted n8n instance.
Store API keys in your workflow configuration rather than hardcoding them anywhere visible. Krom Automation keeps all workflow data, execution logs, and credentials in your own WordPress database, so nothing leaves your server.
That matters if you are integrating with a service that holds customer data and you have GDPR obligations. For a longer look at this question, the self-hosted versus SaaS automation data privacy comparison is worth reading before you choose a platform.
Inbound: Receiving Data from External Services via Webhook
An inbound webhook is a URL that external services call when something happens on their end. Your WordPress site listens, receives the payload, and triggers a workflow in response. This is the pattern used by payment processors, third-party form tools, CRMs, and virtually every modern SaaS platform that offers automation.
Krom Automation Pro’s incoming webhook receiver generates a unique secret URL per workflow. It supports HMAC-SHA256 signature verification so you can confirm the request is genuinely from the service you expect, not a spoofed call. The receiver includes 9 security layers and logs every incoming payload to the execution history.
The incoming webhook receiver documentation covers how to copy the endpoint URL, configure the secret key in the sending service, and map payload fields to actions in your workflow. If you are new to how webhooks work conceptually, our plain-English webhook explainer covers the fundamentals before you touch any settings.
A webhook without signature verification is an open door. Any caller who knows the URL can trigger your workflow.
Once a webhook payload arrives, every field in it is available as a merge tag inside the workflow. If Stripe sends an order total, a customer email, and a product name, all three drop into subsequent actions as dynamic variables. You can branch on those values using conditional yes/no logic, delay follow-up actions by hours or days using the delays and scheduling system, and log every step to the execution audit trail automatically.
What Happens When the External API Fails
This is the section every other integration guide omits. In production, external APIs go down, return 429 rate limit errors, send malformed responses, and time out. Your WordPress site needs to handle all of these without silently dropping data or crashing a workflow.
Krom Automation handles failure in three layers.
- Automatic retry with configurable backoff: When an action fails, the workflow retries automatically on a schedule you control. A transient API outage does not lose the execution permanently.
- Failure notifications by email: You receive an email alert when a workflow execution fails, including which step failed and what the response was. You are not discovering the failure three days later when a customer complains.
- Full per-step execution logs: Every workflow run writes a complete audit trail, including the request sent, the response received, and the outcome of each step. When an API returns a 401 or 403, the log tells you exactly which step failed and what the response body contained.
The analytics dashboard surfaces failed execution counts alongside total executions and active workflow counts. A workflow that fails 20% of the time looks identical to a working one from the outside. The dashboard makes that visible without requiring you to dig through server logs.
| Failure type | What Krom Automation does | What you must configure |
|---|---|---|
| API temporarily down (503, timeout) | Retries with backoff automatically | Set retry count and interval in workflow settings |
| Rate limit hit (429) | Retries after the backoff window | Check the API’s retry-after header guidance |
| Authentication failure (401, 403) | Logs the failure, sends email alert | Rotate your API key and update the workflow |
| Malformed response from external API | Logs the raw response in the execution trail | Add a conditional branch to handle unexpected fields |
| WordPress Cron delay on low-traffic site | Queues via Action Scheduler, runs when cron fires | Configure a real server cron job for time-sensitive flows |
The last row in that table is an honest constraint we want you to know about before you build. Krom Automation runs workflows in the background via Action Scheduler, which depends on WordPress Cron. On sites with very low traffic, WP-Cron may not fire for hours unless you configure a real server-side cron job.
For time-sensitive integrations, such as sending a confirmation within seconds of a payment, configure a real cron. Your hosting control panel or a quick SSH command handles this in under 5 minutes.
When You Genuinely Need a Developer
We are not going to oversell no-code. There are real situations where custom PHP is the right answer, and a site owner who reaches for code too early wastes money, while one who avoids it too long builds a brittle workaround.
Reach for a developer when any of these are true.
- The integration requires OAuth 2.0 with a token refresh cycle that no native integration covers.
- The external API returns data in a deeply nested or non-standard format that requires server-side transformation before WordPress can use it.
- You need to display real-time API data on a public-facing page on every load, which requires caching logic in PHP to avoid hammering the external service.
- The integration involves writing to a proprietary database schema outside WordPress.
- You need bidirectional sync where both systems update each other and conflict resolution logic matters.
In those cases, a developer using wp_remote_get() and wp_remote_post() through the WordPress HTTP API is the correct path. The WordPress HTTP API handles SSL, redirects, and timeout management for you, so the custom code is shorter than most tutorials suggest. A straightforward outbound integration in PHP takes 2 to 4 hours of developer time.
A bidirectional sync with error handling and caching takes 1 to 3 days. Budget accordingly before assuming the custom route is cheaper than a Pro plugin licence.
Custom code is not inherently better than a workflow. It is just harder to hand off to the next person who manages the site.
Connecting Form Submissions to External APIs
Form-to-API is the most common integration request we see. A user submits a contact form, and you want that data in your CRM, email platform, or project management tool. Krom Automation has native triggers for WPForms, Gravity Forms, Contact Form 7, Fluent Forms, and several others.
When a native form trigger exists, every field from the submission is available as a merge tag. You map those fields to your HTTP request body or to a native integration action, and the data flows without any custom code. For the follow-up side of form leads specifically, our guide on automating form lead follow-up walks through the full workflow pattern.
What This Costs: No-Code vs. Custom Development
The honest cost comparison is not plugin licence versus free code. It is total time across setup, testing, and maintenance over 12 months.
| Approach | Year 1 cost | Year 2 cost | Ongoing maintenance |
|---|---|---|---|
| Krom Automation Free (HTTP Request action) | $0 | $0 | Update API key when it rotates. 5 minutes per year. |
| Krom Automation Pro Basic (1 site) | $119/year or $299 lifetime | $119/year or $0 (lifetime) | Same. Retry logic and logging handled automatically. |
| Custom PHP, simple outbound integration | $200 to $600 developer time | $100 to $300 for updates when API changes | Manual monitoring. Failures are invisible unless you add logging. |
| Custom PHP, bidirectional sync | $1,500 to $4,000 developer time | $500 to $1,500 ongoing | Full developer involvement for any API schema change. |
The Pro Basic licence at $299 lifetime breaks even against a single developer hour at typical WordPress agency rates in most markets. The free version covers outbound HTTP requests with no time limit and no run caps, so the only reason to upgrade is when you need a native integration, the incoming webhook receiver, or the visual email builder.
Also from wpRigel
Pollify is our Gutenberg-native poll, survey and quiz plugin. Polls are built as real blocks inside the editor, so there are no shortcodes to paste and no separate interface to learn. If you collect audience feedback alongside your integrations, it fits naturally into the same site.
Commandify is a command palette for the WordPress admin. Press Cmd or Ctrl plus K to search content, jump to any settings page, and run admin actions without clicking through menus. It is the only WordPress command palette with real WooCommerce order, product, and customer management built in, which means it saves time on the admin side of the same sites that benefit most from API integrations.
Frequently Asked Questions
Can I connect to an external API without a plugin?
Yes, using WordPress’s built-in wp_remote_get() and wp_remote_post() functions. A developer writes a few lines of PHP to make the call. The trade-off is that error handling, retry logic, and execution logging are your responsibility to build and maintain.
Does the free version of Krom Automation include the HTTP Request action?
Yes. The HTTP Request action, supporting GET, POST, PUT, PATCH, and DELETE with JSON response parsing, is included in the free version at no cost. The incoming webhook receiver that lets external services push data into WordPress is a Pro feature.
How do I handle API keys securely in WordPress?
Store API keys inside your workflow configuration rather than in theme files or hardcoded in PHP. Krom Automation keeps all credentials in your own WordPress database. Never commit API keys to version control and rotate them immediately if a site is compromised.
What is the difference between an outbound HTTP request and an inbound webhook?
An outbound HTTP request means your WordPress site initiates the call to an external API, typically when something happens on your site. An inbound webhook means an external service calls a URL on your WordPress site when something happens on their end. Both directions are useful and often both are needed in the same integration.
Why is my API call returning a 401 or 403 error?
A 401 means the external API did not recognise your credentials. Check that the API key is correct, that it has not expired, and that you are sending it in the header format the API expects.
A 403 means the credentials are recognised but the key does not have permission for that endpoint. Check the API’s permission scopes and regenerate a key with the correct access level.
Does Krom Automation work without WooCommerce?
Yes. WooCommerce is optional and only required if you want the two WooCommerce-specific free triggers (Order Created and Order Completed) or the WooCommerce actions. Every other trigger and action in the free version works on any WordPress site regardless of what plugins are installed.
The free plugin is available now with no trial period and no run caps. Download Krom Automation from the WordPress.org plugin directory and connect your first external service today.
When you are ready to add the incoming webhook receiver, the visual email builder, and 24 native integrations, see the Pro pricing and choose a plan. Every plan includes every Pro feature, and every plan carries a 14-day money-back guarantee.