Shopify / Shopify/shopify-api-php

Improve "Private App" API usage

Open
#151 44 comments 22 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
473
Forks
193
Avg merge
5h 8m
Merged PRs (30d)
1

Description

Overview/summary

Currently using this library when connecting to a private app is confusing.

It takes quite a long time to work out what you are doing, when it feels like it could be really simple.

Motivation

In our usecase, we only want to consume the Shopify admin api via REST, with a private app access token.

Currently to do that you have to have the following code:

Context::initialize(
  'xxx',                                          // Not used
  'yyy',                                          // Not used
  'read_orders, write_orders',                    // Not used
  'http://localhost',                             // Not used
  new FileSessionStorage('/tmp/php_sessions'),    // Not used
  'latest',
  false,                                          // Not used
  false,                                          // Needs to (incorrectly) be set to false
);

$rest = new Rest($domain, $storeApiToken);

This is not helped by the fact that there is a bug on this line:

https://github.com/Shopify/shopify-php-api/blob/main/src/Clients/Rest.php#L46

So you actually have to Context::initialize with "privateApp" to to false, so it uses the access token not the secret key.

       $headers[HttpHeaders::X_SHOPIFY_ACCESS_TOKEN] =
            Context::$IS_PRIVATE_APP ? Context::$API_SECRET_KEY : $this->accessToken;

There is barely any point in having to call Context::initialize, the only reason for doing it is to:

  • Set Context::$IS_INITIALIZED (to prevent an exception)
  • Default Context::$HTTP_CLIENT_FACTORY = new HttpClientFactory();

In an ideal situation I would just need to do this:

$rest = new Rest($domain, $storeApiToken);
Possible Improvements
  • Remove the need to call Context::initialize
  • Default the API version to 'unstable'
  • Default the initialization of $HTTP_CLIENT_FACTORY if null
  • Don't throw an exception during log if not initialized

Happy to contribute these changes, if you are welcome to receive them.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with src/Clients/Rest.php around the access-token header and trace Context::initialize and its initialization checks. Confirm the desired direct Rest($domain, $storeApiToken) flow, including the listed defaults and logging behavior, then verify the existing API behavior and tests still pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
api, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.