Weave Code
App Php Sdk Laravel Package
shopware/app-php-sdk
A PHP SDK for building Shopware apps. It handles app registration and lifecycle, webhook verification, HMAC request signing, and authenticated communication with the Shopware API, giving PHP developers ready-made tools for secure, reliable app development on the Shopware platform.
Shopware APP SDK Independent of Frameworks
Frequently asked questions about App Php Sdk
- Is shopware/app-php-sdk a Laravel package?
- No. It is a framework-agnostic PHP SDK for building the server side of a Shopware 6 app, and it ships with no Laravel service provider, facade, config file, or adapter. In a Laravel project you host it inside your application as a domain library, and the app backend you build is what Shopware calls out to over HTTPS. You own the routing, dependency injection, persistence, and HTTP transport glue.
- How do I install and wire shopware/app-php-sdk into a Laravel application?
- Install it with Composer on PHP 8.1+ and target Laravel 10 or 11. Then create a service provider that binds the SDK's service interfaces, an Eloquent-backed shop repository, and a dedicated route group for the public endpoints Shopware hits. Keep all the glue in one thin module (for example app/Shopware) rather than spreading it across controllers, and budget roughly three to five engineer-days for scaffolding before any business logic.
- How do I handle the PSR-7 request/response boundary between the SDK and Laravel?
- The SDK consumes Psr\Http\Message\ServerRequestInterface and returns ResponseInterface, while Laravel uses Symfony HttpFoundation, so a bridge is required. Add symfony/psr-http-message-bridge plus a PSR-17 factory such as nyholm/psr7, and apply the conversion only at the edge of the dedicated Shopware route group. Keeping the conversion at that boundary means your controllers and business logic stay in normal Laravel territory.
- How do I verify incoming Shopware webhooks and app requests in Laravel?
- Signature verification is a core feature of the SDK, but you must place it correctly: it needs the raw request body, not the parsed input. Add middleware on the Shopware route group that computes the HMAC-SHA256 of the raw body using the shop's secret and compares it against the shopware-shop-signature header before any controller runs. A misconfigured or missing check is a direct privilege-escalation path into merchant stores, so treat it as a security review item, not just a code review item.
- How should I persist shops when using this SDK with Eloquent?
- The SDK deliberately does not own persistence, so you implement its ShopRepositoryInterface yourself. A typical Eloquent model stores the Shopware shop ID, shop URL, app secret, and an active or terminated state, with the secret encrypted at rest. Make sure repository lookups are keyed on the incoming shop identifier so lifecycle events like uninstall can deactivate the correct record.
- Does the SDK handle Shopware app registration and lifecycle events?
- Yes. The SDK covers the app registration and confirmation handshake as well as lifecycle event handling such as install, update, and uninstall. You still expose the public HTTPS endpoints and route the payloads to the SDK's services, but you do not have to reimplement the protocol semantics. Note that registration can be replayed, so your handlers should be idempotent.
- Does shopware/app-php-sdk manage Shopware Admin API authentication?
- Yes. The SDK includes an Admin API client that handles OAuth client-credentials token acquisition and authenticated communication with the Shopware API, including the required request signing. It does not impose an HTTP transport, so you can plug in a Guzzle or Laravel HTTP client. Store the per-shop credentials and app secret securely, since they grant write access to merchant store data.
- Which Shopware and PHP versions does shopware/app-php-sdk support?
- It is designed for Shopware 6 apps and runs on PHP 8.1 and above, which fits Laravel 10 and 11. Shopware minor releases periodically change header and signature expectations, lifecycle payloads, and Admin API behavior, so pin the SDK version and track the 6.4/6.5/6.6/6.7 support matrix explicitly. Verify the release and version matrix against Packagist and GitHub tags before committing to a roadmap.
- What are the production risks of building a Shopware app backend with this SDK?
- The main risks are ecosystem coupling and security exposure. The SDK is only useful if Shopware 6 is a committed sales channel, and the app holds per-shop secrets plus Admin API credentials, so signature verification must be airtight. Maturity is also a factor: the framework-agnostic SDK has a very small external user base compared with the Symfony shopware/app-bundle, so expect scarce community examples and bug reports for Laravel wiring. If your requirements are purely storefront or administration side, a Shopware plugin is the correct vehicle instead.
- How do I test a Shopware app backend built with this SDK in Laravel?
- There are no official Laravel test helpers, so test at two levels. Unit-test your signature middleware and lifecycle handlers with fixture payloads and a known shop secret, and fake the Admin API HTTP client so token and request signing logic is exercised without network calls. For end-to-end coverage, send requests through the real PSR bridge so raw-body handling and header verification are validated the same way Shopware will hit them in production.
Weaver
How can I help you explore Laravel packages today?