WordPress API Integrations for Agencies: CRM, ERP, Payment & Beyond
The difference between a standard agency build and a high-value agency build is often one thing: integrations. A brochure site that also connects to HubSpot, syncs with Xero and processes payments through Stripe is a completely different project — and priced accordingly. Here is how to approach WordPress API integrations without the common mistakes that derail agency projects.
The Five Most Common Agency Integration Scenarios
1. CRM Integration (HubSpot, Salesforce, Zoho)
The most common agency request. Contact form submissions, newsletter signups and demo bookings need to flow into the client's CRM. The WordPress REST API and webhooks are the standard approach — form submissions trigger a POST request to the CRM's API. Key consideration: handle failures gracefully. If the CRM is down, the form should still capture the lead in WordPress. Never make form submission dependent on a third-party API responding.
2. ERP Integration (Xero, Sage, NetSuite)
WooCommerce orders syncing to accounting software. Product inventory updating across systems. Customer data flowing between platforms. These integrations are complex because they involve two-way data synchronisation — not just one-way pushes. You need to plan for conflict resolution: what happens when inventory numbers disagree between systems?
3. Payment Gateway Integration (Stripe, PayPal, GoCardless)
Beyond standard WooCommerce payments — custom checkout flows, subscription billing, direct debit mandates. Stripe's API is well-documented and developer-friendly. Key consideration: PCI compliance. If you handle card data directly (not through Stripe.js or hosted pages), the compliance burden increases significantly.
4. Email Marketing (Mailchimp, Klaviyo, ActiveCampaign)
Syncing user data, purchase history and behavioural triggers to email platforms. Usually handled via existing plugins, but custom integrations are needed when the client has complex segmentation logic or needs to pass WooCommerce order data into specific email automation flows.
5. Custom API Development
Building your own REST API endpoints in WordPress for external applications to consume. Common for mobile apps, headless front-ends or partner platforms that need to pull data from a WordPress/WooCommerce backend. WordPress's built-in REST API makes this straightforward — register custom endpoints with register_rest_route().
Plugin vs Custom Build: The Decision Framework
| Criteria | Use Existing Plugin | Build Custom Integration |
|---|---|---|
| Standard integration | Yes — WordPress to Mailchimp | No — do not reinvent the wheel |
| Complex business logic | No — plugins rarely handle edge cases | Yes — custom logic needs custom code |
| Two-way sync | Sometimes — test thoroughly | Yes — full control over sync logic |
| Performance-critical | No — plugins add overhead | Yes — optimise for the specific use case |
| Budget under £3,000 | Yes — plugin, configure, move on | No — custom APIs cost more |
Security: What Agencies Get Wrong
- API keys in code: Never hardcode API keys, tokens or passwords in theme files or plugins. Use WordPress constants in wp-config.php, environment variables or secure key management. If a client's site gets compromised, exposed API keys mean the attacker has access to their CRM, payment processor or email platform too.
- No authentication on custom endpoints: If you build a custom REST API endpoint, authenticate it. Use WordPress nonces for front-end requests and application passwords or OAuth for server-to-server calls. Never expose an unauthenticated endpoint that writes data.
- No error handling: Every API call can fail — rate limiting, network issues, service outages, authentication expiry. Wrap every external API call in proper error handling with logging, retry logic and graceful degradation. A CRM being down should not break the contact form.
- GDPR compliance: When integrating with third-party services, data flows outside WordPress. Document what data is sent, to which service and why. The client's privacy policy needs to reflect these integrations — especially for CRMs and email marketing platforms that store personal data.
Testing API Integrations: A Protocol
- Sandbox testing first: Most major APIs (Stripe, PayPal, HubSpot) provide sandbox or test environments. Use them. Do not test payment integrations with real credit cards.
- Failure mode testing: Deliberately break the integration — wrong credentials, expired tokens, server timeout — and verify the system degrades gracefully without data loss.
- Rate limit testing: If the integration processes bulk data (syncing 10,000 products to an ERP), test at full scale. Most APIs have rate limits — your integration needs to respect them.
- Logging: Log every API call — request, response, status code and timestamp. When something breaks six months later, you need to know exactly what happened and when.
Need Custom API Integration Work?
I build and maintain WordPress API integrations for UK agencies — CRM sync, ERP connections, custom REST endpoints and payment gateway work. Properly secured, well-tested and documented for your team.