Skip to content
littleworksdocs

Explore the documentation

Meet LittleworksA little backend for what you’re building on Shopify.Littleworks or your own appWhat it takes to give a Shopify feature a backend: with Littleworks, or with a custom app you build and run yourself.Connect to LittleworksChoose the CLI, a plugin, or a remote MCP connection.CLIConnect from your terminal with Shopify approval and no manual tokens.Claude pluginThe Littleworks MCP connection and agent guidance in one package.OpenAI pluginThe Littleworks MCP connection and agent guidance in one package.MCP with OAuthConnect a compatible client directly, without a marketplace plugin.Build with an agentThe operating guide for agents building on Shopify with Littleworks.Write a workA JavaScript handler, a small manifest, and a version you test and then publish.Keep secretsEncrypted credentials, shared across your store’s works.Call external servicesMake public HTTPS API requests from a work using http.fetch().Store dataDocument collections with a small API, scoped automatically to the work that uses them.Call ShopifyCall Shopify’s Admin and Storefront GraphQL APIs with credentials held by Littleworks.Store filesKeep uploads such as artwork and photos in the merchant’s Shopify Files, uploaded by the browser straight to Shopify.Expose an endpointConnect an existing frontend to a work through a small JSON API.Customer access and invitationsRequire a signed-in shopper or a narrow, expiring invitation before a work runs.RecipesUseful things to build for your store, with the backend already taken care of.Product reviewsCollect customer reviews, verify purchases, and publish approved content directly into your Shopify theme.Customer wishlistsGive signed-in customers a persistent list of products they can revisit across devices.Customer quote requestsCollect a customer’s products, quantities, and requirements without turning a request into an order.Back-in-stock alertsCollect confirmed signups on sold-out variants, email them through your own provider when stock returns, and see every signup and send in your admin.Transactional emailSend email from your works through your own provider, never twice for the same thing, and see what was sent and what failed.Build a merchant pageDescribe your records and what merchants do with them; Littleworks renders a native Shopify admin page.Run works on their ownRun a work when something happens in the store, on a schedule, or from a Shopify Flow workflow.Run background jobsQueue runs for later or in the background: fan out to thousands of customers, import in pages, follow up days later, and retry what fails.MCP tool referenceTools to inspect, deploy, run, and organize the backend for a connected store.Usage and allowancesSee what your works use, how much capacity remains, and when allowances reset.Inspect and troubleshootFind the relevant run, understand the failure, and make the next change deliberately.Limits and securityThe current runtime boundaries, data isolation model, and execution allowances.
Shopify admin
Browse documentation
Build
Markdown

Keep secrets

Encrypted credentials, shared across your store’s works.

Add a secret in Shopify

Open Littleworks → Works → Secrets (also linked from Agent access), then choose Add secret. Enter the name your agent expects and save the value. Names are case-sensitive, start with a letter or underscore, and contain letters, numbers, or underscores, up to 64 characters. A store supports 50 secrets; a value is a non-empty string of up to 8 KiB.

Values are encrypted and never shown again in settings. Replace a value to rotate it without redeploying works. Deleting a secret can break works that need it. Refresh if another person changed the secret while you were editing it.

Read a value inside a work

Read a credential
const apiKey = await secrets.get("EMAIL_API_KEY");

Secrets belong to the store: one value per name, available to every work and group, in test runs and real runs alike. No manifest declaration is required. get returns the string or throws SECRET_NOT_FOUND. A run keeps the first value it reads for a given name. Replacement and deletion apply to new reads in later runs; an in-progress run may still hold the previous value.

Guide the merchant without handling the value

get_context.secrets lists names and timestamps, plus a manageUrl for this store. Explain which key is needed, where to obtain it, and its minimum required provider permissions. Send the merchant to that URL to enter it. Call get_context again to check availability. Never ask them to paste the value into chat, source, a manifest, or a document. There is no management tool that reveals secret values; an agent with code-deployment access can nevertheless write code that reads them.

Avoid exposing credentials

A value read through secrets.get is registered with the SDK and trusted backend redaction filters before it is returned to the work. Exact occurrences are replaced in captured logs and errors, including nested values and free text. This helps prevent accidental leaks; encoding, splitting, or transforming a value can evade matching. Never log a secret, put it in an error, return it to a caller, or save it in a collection. Outputs and stored documents are not automatically redacted.

Use the value with External requests. Shopify credentials remain managed by Littleworks; use shopify.admin.graphql or shopify.storefront.graphql with the corresponding granted scopes.