Weave Code
Bold Shopify Toolkit Laravel Package
bold-commerce/bold-shopify-toolkit
A Laravel toolkit from Bold Commerce for building Shopify integrations. It wraps Shopify's Admin API in a fluent PHP client, with support for GraphQL and REST queries, OAuth token handling, webhook verification, and common store operations so you can ship custom apps faster.
A Symfony Based Shopify api wrapper
Frequently asked questions about Bold Shopify Toolkit
- How do I install bold-commerce/bold-shopify-toolkit in a Laravel app?
- Install it with composer require bold-commerce/bold-shopify-toolkit. The package ships a Laravel service provider and depends on illuminate/support, so auto-discovery registers it in a standard Laravel skeleton. You still need Shopify app credentials such as the API key, secret, and access token in your environment before the client can talk to a store. Check the README for any publishable config and confirm the resolved framework constraint with composer why-not before committing.
- Does this package support both GraphQL and REST Shopify Admin API queries?
- Yes. The Client class handles transport and authentication while the request layer supports both GraphQL and REST Admin API calls, so you can use GraphQL for batched reads and REST where an endpoint is still REST-only. Both paths share the same OAuth token handling and the same response hydration through the package's model layer. Pin your expectations to the Shopify API version the release targets, since Shopify retires versions quarterly.
- Which Laravel versions does bold-shopify-toolkit 8.0 support?
- Version 8.0 widens illuminate/support to ^12 || ^13, but the release notes do not state what the previous constraint was. If 7.x still allowed Laravel 10 or 11, this upgrade will fail Composer resolution at deploy rather than degrade at runtime. Run composer why-not bold-commerce/bold-shopify-toolkit 8.0.0 in your own application to get a definitive answer, and treat Laravel 10 and 11 support as an open question for the maintainer.
- What PHP version does this package require?
- PHP 8.5 is supported in 8.0, but the release notes do not state the declared minimum. Read the php constraint in the package's composer.json before assuming your PHP 8.2 or 8.3 base images are fine. The release also adds explicit nullable parameter types, which is the PHP 8.4 implicit-nullable deprecation fix and suggests a newer toolchain. Verify the floor against your CI matrix and any managed-platform PHP pinning.
- How do I verify Shopify webhooks with this toolkit?
- Webhook verification is built in, so you can validate the HMAC signature Shopify sends against your app's shared secret before touching the payload. The usual pattern is a controller that verifies first, returns a 401 on mismatch, and only then dispatches your own job or writes to the database. Keep that check synchronous and fast so Shopify does not mark the endpoint as failing. Treat unverified payloads as untrusted input even on internal-only routes.
- How does OAuth access token handling work for a Shopify app?
- The Client handles OAuth token handling against the Admin API, so you exchange and use tokens through the toolkit instead of hand-rolling those requests. Tokens are per-shop, so plan for storage keyed by shop domain and for re-install or refresh flows when a merchant reinstalls your app. Keep the API secret and tokens out of source control and rotate them through your normal secret management. Confirm how the package expects tokens to be passed if you are building a multi-tenant install flow.
- Is this package Laravel-only or can I use it with Symfony or plain PHP?
- The package is distributed with a Laravel service provider and an illuminate/support dependency, and it is positioned as a Laravel toolkit, while its README lineage describes a Symfony-based Shopify API wrapper. In practice the client is plain PHP, so the transport and domain classes can be used outside Laravel, but the Laravel integration is the documented path. If you are a Symfony shop, confirm with the maintainer which framework is actually supported before sign-off.
- What breaks when upgrading from 7.x to 8.0?
- The signature-level break is explicit nullable parameter types on Asset, Base, Cart, and Client, which turns subclass overrides with mismatched signatures into fatal errors instead of deprecation notices. It also invalidates reflection or static-analysis snapshots in your test suite. The widened illuminate/support constraint is the bigger practical risk, since it may silently drop Laravel 10 and 11. Note that the 8.0.0 tag is byte-identical to 8.0.0-beta.6, so run your own staging canary rather than inheriting the vendor's testing confidence.
- Does the package handle Shopify API rate limits and retries?
- No documented retry or backoff policy ships with this release, so throttling is left to the caller. Shopify enforces separate REST leaky-bucket and GraphQL cost limits, so implement backoff that respects the Retry-After header and reduces concurrency on sustained 429 responses. Because the toolkit is an outbound-only adapter with no queue or scheduler assumptions, wrapping calls in a rate-limited job is straightforward. Log the rate-limit response headers so you can see bucket state before you hit the ceiling.
- How do I test Shopify integrations without hitting the live API?
- Mock the Client or the underlying HTTP transport so tests never reach Shopify, and assert on the request shape rather than a live response. Model hydration runs through Base::unserializeModel(), a hand-rolled path that sits alongside Eloquent and JsonSerializable, so cover it with fixture payloads from the Shopify API version you target. Keep a small integration suite against a development store for the paths that matter most. Do not assume Laravel's upgrade guarantees cover that hydration layer, because they do not.
Weaver
How can I help you explore Laravel packages today?