Skip to main content
Back to changelog

Build Shopify apps in PHP and Python with new official packages

Shopify releases official PHP and Python app packages

Shopify now publishes official, open-source packages for building apps in PHP and Python. shopify/shopify-app-php on Packagist and shopifyapp on PyPI have reached version 1.0.

They provide framework-agnostic primitives for request verification, token exchange, and Admin GraphQL requests. If you build apps in PHP or Python, you can adopt them today.

What changed

Two new packages are generally available:

composer require shopify/shopify-app-php
pip install shopifyapp

Both expose the same primitives, so you can compose the ones you need instead of adopting a full framework:

  • Request verification for webhooks, App Home and App Bridge requests, app proxy requests, and Checkout, POS, Admin, Customer Account, and Flow extension requests
  • Token exchange, including client credentials and refreshing exchanged access tokens
  • An Admin GraphQL client with automatic retry handling

They work with any stack, including Laravel, Symfony, Django, FastAPI, or plain PHP and Python.

The previous shopify-api-php and shopify_python_api libraries are now deprecated. They continue to work, but will not receive new features or security fixes.

shopify-api-php is marked as abandoned on Packagist, and shopify_python_api is marked as inactive on PyPI. Both point developers to the new packages.

Who is affected

This affects developers building Shopify apps in PHP or Python.

It does not change anything for apps built with the Node.js or Ruby libraries, and React Router remains the recommended path for most new apps.

Apps already using the older libraries continue to work with no immediate action required.

Why this matters

The packages are small and explicit. Each primitive maps to one step of the secure setup, making the flow visible in your code and easier for you or an AI tool to understand.

They are also consistent across languages. Both packages implement the same contract and pass the same test suite, so improvements in one benefit the other.

They are designed for incremental adoption, so you can migrate one route at a time instead of rewriting an entire app.

What to do

There is no app template for PHP or Python. Instead, scaffold your own project and compose the primitives you need.

Each package’s README documents every primitive and can be provided as context to an AI coding tool when scaffolding your app.

If you are starting a new PHP or Python app:

  1. Install the package for your language.
  2. Scaffold your project using your preferred framework or stack.
  3. Compose the primitives you need, for example by verifying an incoming request and then exchanging the token.
  4. Confirm that requests verify successfully and that token exchange returns an access token in a development store.

Example PHP usage:

$shopify = new Shopify\App\ShopifyApp($clientId, $clientSecret);

$result = $shopify->verifyAppHomeReq($request);

This example verifies an App Home request. On success, $result provides the verified $result->shop and $result->idToken, which you can exchange for an access token. It also includes a log and a response to return to the client.

Use the matching verify... method for the surface you are handling, and use these values directly instead of parsing or re-verifying the request yourself.

If you maintain an app using shopify-api-php or shopify_python_api, there is no forced migration or removal date. When you are ready, follow the upgrade notes in the new package’s README and migrate incrementally.

Related docs

Was this page helpful?