SquidCore – ERP & CRM Platform

SquidCore – ERP & CRM Platform connects your WooCommerce store to SquidCore, the ERP & CRM platform for Brazilian businesses. Your catalog and your orders reach SquidCore on their own, and the electronic invoice (NF-e) of each paid order is issued by SquidCore and delivered back to the order, to the customer area and to the order emails.

A SquidCore account is required. The plugin itself is free; the features available in SquidCore depend on your SquidCore plan.

Key Features

• One-click connection: click Connect with SquidCore, sign in and authorize the store; the WooCommerce REST API keys SquidCore needs are created for you (a manual connection with an access token is still available)
• Catalog sync: products, variations and categories are sent to SquidCore when they are created, updated, trashed or deleted
• Order sync: new orders, status changes and confirmed payments are sent to SquidCore, including the Brazilian checkout fields (CPF, CNPJ, number, neighborhood)
• Automatic NF-e after payment: when the order is paid, SquidCore issues the NF-e and the plugin keeps the order up to date with its status
• Manual control: issue, retry or cancel the NF-e from the order screen whenever you need
• DANFE and XML in the order: download the DANFE (PDF), the XML and the cancellation XML from the order screen and from the orders list column
• DANFE and XML for the customer: download links in My Account > Orders and in the WooCommerce order emails
• NCM with AI: an NCM field on every product, also used by Correios Automático, and SquidCore’s AI can fill the missing NCM codes of an order before the invoice is issued
• Products without NCM at a glance: the dashboard shows how many products still need an NCM, counted in the background, and the products list gets a Without NCM view
• Import from WebmaniaBR: bring the NCM codes you already saved in the Nota Fiscal Eletrônica WooCommerce plugin (WebmaniaBR), with a preview before anything is saved and an undo
• One invoice per order: orders that already have an NF-e issued by WebmaniaBR do not get a second one automatically
• Attention notices: invoices that need your action are flagged in the admin
• Plan limit at a glance: the dashboard and the Invoices screen show the invoices of the month against your SquidCore plan; when the limit is reached, one notice tells how many orders are waiting, links to the plans and, after you change plan, issues them all again in the background
• Correios Automático integration: the NF-e issued by SquidCore is handed to the Correios Automático plugin, so the Correios pre-posting goes out with the NF-e instead of a content declaration
• Simplified DANFE on the labels: with Correios Automático 1.12 or later, the simplified DANFE (DANFE Simplificado – Etiqueta) of the NF-e prints with the shipping labels; the orders list gets a link and a bulk action to print it, and the order screen a button
• Background processing: sync and invoice jobs run in the background with automatic retries, so checkout is never slowed down

Getting Started

1. Install and activate the plugin
2. Open SquidCore in the WordPress admin menu and click Connect with SquidCore
3. Sign in to SquidCore, choose the company and authorize the store; you are sent back to WordPress already connected
4. Choose which data to sync and turn on automatic NF-e
5. Done: new orders and products flow to SquidCore and invoices come back to the orders

Stores that cannot use the button (for example a WordPress admin without https) can open Manual connection (token) in the connection settings and paste a plugin token generated in SquidCore under Integrations > WooCommerce.

Source code and build

The plugin code is public at https://github.com/infixs/infixs-squidcore-erp. The admin screens run on compiled JavaScript (assets/dashboard/js/main.js), built with Vite from Vue 3 and TypeScript; the human-readable source of those screens is in the resources/src/views folder of that repository.

The PHP dependencies in vendor/ (the AvelPress framework) are installed by Composer from the included composer.json; the release build of the AvelPress CLI (avel build) prefixes their namespaces with Infixs\SquidCore\ so they never clash with other plugins.

External services

This plugin relies on external services to work. Nothing is sent before you connect it: while the store is not connected, opening the plugin screens sends nothing, and the first request goes out when you click Connect with SquidCore (or save a manual token). The deactivation feedback is sent only if you submit it.

SquidCore API

The plugin is a connector for the SquidCore ERP platform, provided by Infixs. It talks to the SquidCore API at https://api.squidcore.com.

• When you click Connect with SquidCore: the plugin first reads the public OAuth metadata of the API (https://api.squidcore.com/.well-known/oauth-authorization-server) to check that the connection is offered; as with any request WordPress makes, your site address goes in the user agent. The answer is cached for up to 12 hours. Then your browser is sent to SquidCore (https://api.squidcore.com/v1/oauth/authorize, then the SquidCore sign-in and consent screens), with the plugin’s public client id, the address of your WordPress admin to return to, the requested permissions and one-time security codes (state and PKCE). You sign in and authorize there; SquidCore sends your browser back to your WordPress admin.
• When SquidCore sends you back: the one-time authorization code is exchanged for an access token at https://api.squidcore.com/v1/oauth/token. The plugin then creates a WooCommerce REST API key (read/write) for your WordPress user and sends it, with your site URL, the store name and the plugin version, to https://api.squidcore.com/v1/integrations/apps/woocommerce/connect, so SquidCore can read and update the store through the WooCommerce REST API. The access token is stored in your WordPress database. If SquidCore refuses the connection, the key is deleted and the token is revoked (https://api.squidcore.com/v1/oauth/revoke).
• When you connect or test the connection: the access token (from Connect with SquidCore, or the one you entered in the manual connection) is sent as an authorization header, along with your site URL and the plugin version, to validate the connection and read the name of your SquidCore organization.
• When products, variations or categories are created, updated, trashed or deleted: the item data is sent (name, SKU, descriptions, prices, stock, dimensions, weight, attributes, image URLs, categories, tags and NCM), along with your site URL.
• When orders are created, change status or are paid: the order data is sent, including the customer’s name, company, email, phone, billing and shipping addresses, Brazilian fields (CPF, CNPJ, IE, RG, number, neighborhood, cell phone), order items, totals, shipping, fees, coupons, payment method and customer note, along with your site URL.
• When an NF-e is issued, checked, cancelled or downloaded: the order identifier and the requested action are sent, and the invoice status, DANFE (PDF) and XML files are received.
• When you check the NF-e numbering of a store that used WebmaniaBR: the Import data tab and the NF-e settings read from SquidCore the NF-e series with their next and last numbers (https://api.squidcore.com/v1/tax-invoice/nfe/numeracoes and https://api.squidcore.com/v1/tax-invoice/nfe/numeracoes/emitidos) and the tax defaults of your company, such as the CFOP and the operation nature (https://api.squidcore.com/v1/tax-invoice/fiscal-settings), so you can continue the numbering where WebmaniaBR stopped. Only the access token goes with these reads: nothing about the WebmaniaBR invoices is sent. The answer is cached for 10 minutes.
• To show the invoices of the month against your plan: the dashboard and the Invoices screen read from SquidCore how many NF-e and NFC-e your organization issued this month and the invoice limit of its plan (https://api.squidcore.com/v1/integrations/apps/woocommerce/nfe/usage). The read runs in the background, at most every 10 minutes while the SquidCore pages of the WordPress admin are open and shortly after an invoice is authorized, and right away when you click Refresh. Only the access token goes with it. The answer is cached for up to a day.
• When an NF-e is authorized and Correios Automático 1.12 or later is active: the authorized XML of the invoice is downloaded once from https://api.squidcore.com/v1/integrations/apps/woocommerce/orders/{order id}/nfe/xml, and only what the simplified DANFE prints is kept in the order: the access key, the authorization protocol and date, the number, series and issue date, the names, CPF or CNPJ, state registrations and states of the issuer and the recipient, and the total (no address, email or phone). When Correios Automático starts printing the simplified DANFE, the invoices authorized in the last 45 days on orders still to ship are read the same way, once, in the background; a label printed before an invoice was read downloads its XML then. Only the order identifier and the access token go with these downloads. The data is removed when the invoice is cancelled and when the plugin is deleted.
• When you ask the AI to fill missing NCM codes: the order identifier and the IDs of the products to classify are sent. SquidCore classifies those products with the AI provider your organization connected in SquidCore (for example OpenAI or Anthropic), under the SquidCore Privacy Policy.

Sync can be turned off in the plugin settings, and disconnecting the plugin stops all calls to the SquidCore API and deletes the WooCommerce REST API key the plugin created. Disconnecting a store connected with Connect with SquidCore also tells SquidCore to revoke the authorization (https://api.squidcore.com/v1/integrations/apps/woocommerce/disconnect). The authorization can also be revoked in SquidCore, under Settings > Connected apps. Deleting the plugin does the same as disconnecting and also removes the plugin settings, with the stored tokens, and the simplified DANFE data kept in the orders.

SquidCore Terms of Service and Privacy Policy.

Infixs deactivation feedback

When you deactivate the plugin on the Plugins screen, a form asks why. Only the Submit & deactivate button sends it: the reason, the optional email and description you typed, your site URL, the PHP version and the plugin version go to the Infixs API (https://api.infixs.io/v1/plugin/deactivate), so Infixs can improve the plugin. Skip & deactivate, I changed my mind and closing the form send nothing.

Infixs Privacy Policy.

WhatsApp support link

The help menu and the deactivation form have a WhatsApp Support link. The plugin sends nothing: only if you click it, your browser opens WhatsApp (https://api.whatsapp.com) with the Infixs support number and a ready-made greeting, and what you then send goes through WhatsApp.

WhatsApp Terms of Service and Privacy Policy.