Weave Code
Shopify App Php Laravel Package
shopify/shopify-app-php
A PHP library for building Shopify apps, with tools for OAuth, session storage, webhooks, and Shopify API access to help integrate stores into Laravel or plain PHP projects.
shopify/shopify-app-php is a PHP toolkit for building Shopify apps with idiomatic OAuth, webhook verification, and Admin API access. It helps you scaffold secure embedded apps, manage access tokens, and handle Shopify requests without reinventing auth and HMAC validation.
- OAuth flow helpers for app installation and token exchange
- Webhook verification and handlers for reliable event processing
- Admin API client with pagination and error handling
- Session/token storage abstractions for custom backends
- Framework-friendly setup for Laravel and plain PHP
Frequently asked questions about Shopify App Php
- How do I install shopify/shopify-app-php in a Laravel app with Composer?
- Install the package with Composer using composer require shopify/shopify-app-php, then confirm the PHP and Laravel version constraints against your existing lock file. Because the SDK is framework-agnostic, expect to add Laravel glue such as a service provider, configuration file, OAuth routes, and a webhook controller. Run a short spike that completes an install, verifies one webhook, and makes one Admin API call before committing to wider use.
- Is shopify/shopify-app-php compatible with Laravel 10, 11, and 12?
- The package is a PHP toolkit rather than a Laravel-native package, so compatibility depends on its PHP version constraints and your Laravel release. Confirm PHP 8.x support and test against your exact Laravel version in staging before production. Since Laravel 10, 11, and 12 differ in service-provider and HTTP client details, document any required bindings and pin the package version once verified.
- Does shopify/shopify-app-php handle Shopify OAuth installation and access tokens for me?
- The package provides helpers for Shopify OAuth and session storage, which should reduce custom work for the install flow and token handling. You will still need to design how online and offline tokens are stored, refreshed, and revoked, especially for multi-store isolation. Wrap token access behind an internal repository interface so you can adapt storage without rewriting app logic.
- How does shopify/shopify-app-php verify webhook HMACs and handle idempotency?
- The SDK includes webhook HMAC verification helpers, which is a strong reason to keep it at the Shopify integration boundary even if you write custom adapters elsewhere. HMAC verification alone does not guarantee idempotency, so plan to queue webhook processing and deduplicate by webhook ID or topic plus shop. Validate replay behavior and failure handling in a spike before relying on it for production order or fulfillment events.
- Can I use shopify/shopify-app-php for embedded Shopify apps with session token validation?
- Yes, the package is aimed at common Shopify app plumbing including session token validation, which fits embedded app backends. In Laravel you will likely need middleware to validate session tokens on API routes and to resolve the current shop. Keep that middleware thin and delegate domain logic to services that do not depend directly on the SDK.
- Does shopify/shopify-app-php include Laravel-ready session, cache, or Eloquent storage adapters?
- The package is described as working with Laravel and other PHP frameworks, but it is not presented as Laravel-native, so expect to write or configure your own storage adapters. Plan for an Eloquent or repository layer for shops and tokens, plus compatibility with Redis or database cache and queue workers. Confirm in a spike whether any built-in session storage meets your multi-store isolation and revocation requirements.
- Which Shopify Admin API versions and GraphQL client does shopify/shopify-app-php support?
- The package provides Admin API access helpers, but the exact supported Shopify API versions and GraphQL client behavior should be verified against the package source and release notes. Shopify deprecates API versions on a regular schedule, so pin the package and the API version together. Add an internal Admin API adapter so version upgrades and rate-limit handling stay isolated from your app logic.
- How should I test Shopify OAuth and webhooks locally without a public app URL?
- Plan for a tunnel or a Shopify development store so OAuth redirects and webhook deliveries can reach your local Laravel app. Test HMAC verification, replay handling, and token storage with fixtures before connecting a real merchant. A time-boxed proof of concept should prove the install flow, one webhook, and one Admin API query without requiring a production app.
- Is shopify/shopify-app-php safe for production if it has few GitHub stars?
- Official Shopify ownership and an MIT license reduce legal and vendor risk, but low stars and limited community examples are weak maintenance signals. Treat the SDK as a security-sensitive dependency: pin the version, wrap it behind internal interfaces, and assign an owner to track releases and Shopify API changes. For production-critical launches, confirm Shopify Partner support paths and keep a fallback plan for custom OAuth and HMAC code.
- What are alternatives to shopify/shopify-app-php for Laravel Shopify apps?
- Alternatives include building thin custom OAuth and HMAC handling in Laravel, using community Laravel Shopify packages, or adopting Shopify’s official SDKs in other languages alongside a PHP backend. The official PHP SDK is a reasonable fit when you want Shopify-maintained plumbing but can accept framework-agnostic integration work. Compare alternatives on Laravel-native storage adapters, webhook idempotency, API version support, and long-term maintenance before migrating.
Weaver
How can I help you explore Laravel packages today?