# Allow access only after customer placed order in Woocommerce **URL:** \ **Category:** Get Help\ **Tags:** react, whitelist, wordpress, login, auth0\ **Created:** [March 27, 2021, 11:37pm UTC](https://community.auth0.com/t/allow-access-only-after-customer-placed-order-in-woocommerce/60194 "2021-03-27T23:37:59Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![benshitritdan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/benshitritdan/32/13314_2.png) [@benshitritdan](https://community.auth0.com/u/benshitritdan)\ **Post date:** [March 27, 2021, 11:37pm UTC](https://community.auth0.com/t/allow-access-only-after-customer-placed-order-in-woocommerce/60194/1 "2021-03-27T23:37:59Z")
Hey there, I’m working on a React Node JS Web App right now, basically I’m planning to host this app on a subdomain to a Wordpress site with Woocommerce. And the final plan is to give access to the Node JS app only for customers who paid for buying the subscription (one time payment) on my Woocommerce site. I already saw that there is no straight support for Woocommerce migration. I do know that I can migrate WP MySQL database in order to migrate the users. But that still leave me with 1 issue: How can i prevent people who didn’t purchase to sign up through Auth0? I thought about Email addresses whitelist but not sure how to approach and if that’s a good fit. I’m also okay with passwordless access but it has to be only for the customers emails. I also thought about disable the signup through auth0 widget \>\> migrate new users only from Wordpress database \>\> only login to the app through auth0. Any suggestions for the best practice and solution for this one? ---
**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\ **Post date:** [March 29, 2021, 3:09pm UTC](https://community.auth0.com/t/allow-access-only-after-customer-placed-order-in-woocommerce/60194/3 "2021-03-29T15:09:26Z")
Hi @benshitritdan, Welcome to the Community! Here are a couple of ideas that come to mind: **WooCommerce Webhook + Invite Flow** When an order is complete for your service, you could use a WooCommerce [webhook](https://docs.woocommerce.com/document/webhooks/) to notify a third-party job queue service that the user should be given access to your API. Something I’ve seen before when working with AWS is setting up an API Gateway → SQS → Lambda integration so that the WooCommerce webhook calls the API gateway and then a job is queued in the SQS service which triggers the Lambda function that updates the user’s data in the other system. There are probably simpler ways to handle this, but the idea is that the webhook would kick off a job that would be responsible for creating the user in Auth0. You’d likely want to use a queuing service like AWS’s SQS service so that you could monitor if anything ever went wrong with the integration. Once you’ve decided how WooCommerce will send out the message that the user has completed their order, you could set up an invite-only flow for your application: > **[Send Email Invitations for Application Signup](https://auth0.com/docs/customize/email/send-email-invitations-for-application-signup)** > > Describes how to customize the signup process to invite users to signup for an account in the context of a specific Auth0 application. **Auth0 Rule** Alternatively, another idea would be to call the [WooCommerce REST API](https://woocommerce.github.io/woocommerce-rest-api-docs) from within an [Auth0 Rule](https://auth0.com/docs/rules) to see if the user has purchased your service. If they have, then you can either [assign a role](https://auth0.com/docs/authorization/rbac) to the user that gives them the permissions they need (ideal if you ever want a tiered service) or you can simply add a flag to the user’s [app metadata](https://auth0.com/docs/users/metadata). The rule would throw an authorization error if the user has not purchased your service. > **[Rules for Authorization Policies](https://auth0.com/docs/manage-users/access-control/rules-for-authorization-policies)** > > Understand how rules apply to authorization policies and Auth0's role-based access system (RBAC). ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [April 13, 2021, 3:09pm UTC](https://community.auth0.com/t/allow-access-only-after-customer-placed-order-in-woocommerce/60194/4 "2021-04-13T15:09:42Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.