Developer Changelog / New packages

Building Shopify apps in PHP and Python
The official packages hit v1.0

Request validation, token exchange, and Admin GraphQL, delivered as three framework-agnostic building blocks. Works with Laravel / Symfony / Django / FastAPI, or plain PHP and Python. The older shopify-api-php / shopify_python_api are now deprecated.

What's on this page
  1. The 30-second version: what shipped
  2. The three primitives you get
  3. Diagram: what happens when a request arrives
  4. Old libraries vs. new packages
  5. Who this affects, and who it doesn't
  6. Getting started in 4 steps, with code
  7. 5 things engineers should know
  8. 3 ways to put this to work
  9. A one-line summary for your pitch

1The 30-second version: what shipped

Shopify has released official open-source packages for PHP and Python, and both have reached version 1.0 .
Packagist's shopify/shopify-app-php and PyPI's shopifyapp.
Not a full-stack framework, buta set of primitives you assemble from only the parts you need. Ready to adopt today.

Two new packages are GA

Install with composer for PHP and pip for Python. Both are generally available (GA).

Framework-agnostic

Runs on any stack: Laravel / Symfony / Django / FastAPI, or plain PHP and Python.

The old libraries are deprecated

shopify-api-php is abandoned andshopify_python_api is now inactive. They still work, but no new features or security fixes are coming.

2The three primitives you get

Both packagesthe same primitivesare exposed. You don't have to adopt the whole framework — you compose only the pieces you need.

1. Request verification

This covers webhooks, App Home, App Bridge requests, App Proxy requests, and requests from Checkout / POS / Admin / Customer Account / Flow extensions.

2. Token exchange

Token exchange.client credentials , plusrefreshof already-exchanged access tokens.

3. Admin GraphQL client

Automatic retry handlingbuilt into the Admin GraphQL client.

"Small and explicit" is the design philosophy: each primitive maps to one step of a secure setup. That keeps the flow visible in code, making iteasier to understand for you and for AI tools alike, the article explains.

3Diagram: what happens after a request arrives

Incoming request App Home / Webhook App Proxy / extensions Arrives from Shopify verify... methods Call the verification method that matches each surface Primitive 1 $result shop idToken log / response Value returned on successful verification Token exchange Exchange idToken for an access token Primitive 2 Admin GraphQL Primitive 3
Use the shop / idToken returned by verification as-is— that is the correct usage. Do not re-parse or re-verify the request yourself (an explicit instruction in the article).

4Old libraries vs. new packages

ItemOld: shopify-api-php / shopify_python_apiNew: shopify-app-php / shopifyapp
Status Deprecated Abandoned on Packagist, inactive on PyPI GA Reached v1.0
New features Not coming Actively developed
Security fixes Not coming Provided
Behavior Keeps working —
Migration deadline None No forced migration and no removal date have been set. When you're ready, follow the upgrade notes in the README andmigrate gradually
App templates — None No templates are provided for PHP / Python — you scaffold the project yourself
The old libraries are in a "it works, butno security fixes are coming" state. There's no deadline, but the risk of leaving them alone grows over time = migration is now a task where you decide "when to do it" yourself.

5Who's affected / who isn't

Affected

Developers building Shopify apps in PHP / Python

For new projects, adopt the new packages. Existing apps keep running withno immediate action required.

Not affected

Apps on the Node.js / Ruby libraries

Nothing changes for them with this update.

No change

Recommended path for new apps

React Router remains the "recommended path for most new apps."

6Setup steps (4 steps) and code examples

Exactly the steps from the article's "Starting a new PHP / Python app" section.

1

Install the package

Install the package for your language.

2

Scaffold the project

Build it yourself with your preferred framework / stack.

3

Combine the primitives

Example: verify the request → exchange the token.

4

Verify on a development store

Confirm that validation succeeds and that the token exchange returns an access token.

Install : PHP
composer require shopify/shopify-app-php
Install : Python
pip install shopifyapp
PHP usage example (validating an App Home request)
$shopify = new Shopify\App\ShopifyApp($clientId, $clientSecret);
$result = $shopify->verifyAppHomeReq($request);

On successful validation, $result gives you

$result->shop : the validated shop
$result->idToken : an ID token you can exchange for an access token
log, plus the response

Use the verify... method that matches the surface you're handling

Webhook / App Home / App Bridge / App Proxy / Checkout / POS / Admin / Customer Account / Flow ── pick the matching method. Use the returned valuesas-is(don't parse or re-validate them yourself).

Each package's README documents every primitive. The post explicitly assumes you can pass the README to an AI coding tool as contextwhen scaffolding.

75 points engineers should know

1. A set of primitives, not a framework

Rather than "adopt an all-in-one framework," the design lets youcompose only the pieces you need. You can drop it into an existing project without breaking its structure.

2. Incremental migration (one route at a time) is the premise

It's designed so you migrate one route at a time, not rewrite the whole app. There's no forced migration or removal date for users of the older libraries, so you can plan the move at your own pace.

3. Consistent behavior across languages

Both packagesimplement the same contract and pass the same test suite. An improvement to one benefits the other, and your PHP and Python teams won't have to debate behavioral differences.

4. Automatic retries for Admin GraphQL are built in

The client includesautomatic retry handling. Any place where you wrote your own backoff is a candidate for replacement. The exact retry conditions arenot specified ── check the README.

5. No template means you scaffold it yourself and feed the README to an AI

No app template is provided for PHP / Python. Instead, the README documents every primitive, andpassing it as context to AI coding toolsis an officially intended way to use it. That is consistent with the design intent: a small, explicit API is readable by humans and AI alike.

8Three use cases you can put to work

Laravel Django FastAPI Official Building blocks
USE CASE 1

Bolt a Shopify app onto an existing PHP / Python core system

Challenge
Your in-house core and order management systems run on Laravel or Django, and standing up a separate Node.js app just for Shopify integration duplicates your auth, deployment, and operations stack.
Approach
Add the official package to your existing PHP / Python project and drop only the primitives you need (request verification + token exchange) into your existing routes.
Impact
You can implement Shopify integration without adding another language or deployment stack, and maintain it with your existing team's skill set.
Technical note
It is framework-agnostic, so Laravel / Symfony / Django / FastAPI / plain PHP or Python all work. There is no app template, so you scaffold it yourself.
Old library New route A New route B New route C Migrate one route at a time
USE CASE 2

Plan a no-deadline, phased migration off the deprecated library

Challenge
A production app depends on shopify-api-php / shopify_python_api . It still works, but it is treated as abandoned / inactive, sono security fixes are coming.
Approach
There is no forced migration and no removal date, so follow the upgrade notes in the README and plan to swap in the new packageroute by route, a little at a time. Start with the higher-risk request verification and token exchange.
Impact
You can move onto a foundation that receives security fixes without freezing development for a large rewrite. It is also easy to present as justification for a maintenance estimate.
Technical note
No deadline means the priority slips easily. Use the fact that no security fixes are coming as the deciding factor, and explicitly agree internally on when to migrate.
README AI scaffold
USE CASE 3

Assume there is no template: hand the README to an AI to speed up initial setup

Challenge
There is no app template for PHP / Python, so you end up designing the initial project setup from scratch every time.
What to do
Feed each package's README (all primitives are documented) to your AI coding tools as context, and generate a scaffold that matches your own standard stack.
Impact
Because this is the officially intended usage, it compresses the design cost of initial setup while making it harder to stray from the correct way to combine the primitives.
Technical notes
Each primitive maps to one step of a secure setup, so when reviewing generated code it's easy to see which step is missing. At the end, always verify successful validation and token exchange on a real development store.

9One-line summary you can use in a proposal

"You can now build Shopify apps in PHP and Python with official packages (v1.0 GA).
Just three parts — validation, token exchange, and Admin GraphQL — drop straight into your existing Laravel / Django app.
The older libraries are deprecated (no security fixes), but there's no end date, so you can migrate one route at a time."