Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@shopify/shopify-api
Advanced tools
Shopify API Library for Node - accelerate development with support for authentication, graphql proxy, webhooks
@shopify/shopify-api
This library provides support for the backends of TypeScript/JavaScript Shopify apps to access the Shopify Admin API, by making it easier to perform the following actions:
Once your app has access to the Admin API, you can also access the Shopify Storefront API to run GraphQL queries using the unauthenticated_*
access scopes.
This library can be used in any application that runs on one of the supported runtimes. It doesn't rely on any specific framework, so you can include it alongside your preferred stack and only use the features that you need to build your app.
Note: this package will enable your app's backend to work with Shopify APIs, but you'll need to use Shopify App Bridge in your frontend if you're planning on embedding your app into the Shopify Admin.
To follow these usage guides, you will need to:
ngrok
URL and the appropriate redirect for your OAuth callback route to your app settingsTo install this package, you can run this on your terminal:
# You can use your preferred Node package manager
pnpm add @shopify/shopify-api
Note: throughout these docs, we'll provide some examples of how this library may be used in an app using the Express.js framework for simplicity, but you can use it with any framework you prefer, as mentioned before.
The first thing you need to import is the adapter for your app's runtime. This will internally set up the library to use the right defaults and behaviours for the runtime.
import '@shopify/shopify-api/adapters/node';
import '@shopify/shopify-api/adapters/cf-worker';
import '@shopify/shopify-api/adapters/web-api';
Next, configure the library - you'll need some values in advance:
Client ID
)Client secret
)Call shopifyApi
(see reference) to create your library object before setting up your app itself:
import '@shopify/shopify-api/adapters/node';
import {shopifyApi, LATEST_API_VERSION} from '@shopify/shopify-api';
import express from 'express';
const shopify = shopifyApi({
// The next 4 values are typically read from environment variables for added security
apiKey: 'APIKeyFromPartnersDashboard',
apiSecretKey: 'APISecretFromPartnersDashboard',
scopes: ['read_products'],
hostName: 'ngrok-tunnel-address',
...
});
const app = express();
Once you configure your app, you can use this package to access the Shopify APIs. See the reference documentation for details on all the methods provided by this package.
See the specific documentation in the Guides section for high-level instructions on how to get API access tokens and use them to query the APIs.
As a general rule, apps will want to interact with the Admin API to fetch / submit data to Shopify. To do that, apps will need to:
Before v6, this library only worked on Node.js runtimes. It now supports multiple runtimes through the use of adapters, more of which can be added over time. If an adapter for the runtime you wish to use doesn't exist, you can create your own adapter by implementing some key functions, or contribute a PR to this repository.
In addition to updating the library to work on different runtimes, we've also improved its public interface to make it easier for apps to load only the features they need from the library. If you're upgrading an existing app on v5 or earlier, please see the migration guide for v6.
FAQs
Shopify API Library for Node - accelerate development with support for authentication, graphql proxy, webhooks
The npm package @shopify/shopify-api receives a total of 73,323 weekly downloads. As such, @shopify/shopify-api popularity was classified as popular.
We found that @shopify/shopify-api demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 24 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.