Skip to content
littleworksdocs

Explore the documentation

Meet LittleworksA little backend for what you’re building on Shopify.Connect to LittleworksChoose the CLI, a plugin, or a remote MCP connection.CLIConnect from your terminal with Shopify approval and no manual tokens.Claude pluginThe Littleworks MCP connection and agent guidance in one package.OpenAI pluginThe Littleworks MCP connection and agent guidance in one package.MCP with OAuthConnect a compatible client directly, without a marketplace plugin.Build with an agentThe operating guide for agents building on Shopify with Littleworks.Write a workA JavaScript handler, a small manifest, and an immutable version each time you deploy.Keep secretsEncrypted credentials, shared across your store’s works.Call external servicesMake public HTTPS API requests from a work using http.fetch().Store dataDocument collections with a small API, scoped automatically to the work that uses them.Call ShopifyUse Shopify’s GraphQL API directly, with credentials held by Littleworks.Expose an endpointConnect an existing frontend to a work through a small JSON API.MCP tool referenceTen tools to inspect, deploy, run, and manage the backend for a connected store.Inspect and troubleshootFind the relevant run, understand the failure, and make the next change deliberately.Limits and securityThe current runtime boundaries, data isolation model, and execution allowances.
Shopify admin
Browse documentation
Build
Markdown

Keep secrets

Encrypted credentials, shared across your store’s works.

Add a secret in Shopify

Open Littleworks → Works → Secrets (also linked from Agent access), then choose Add secret. Enter the name your agent expects, select Preview or Live, and save the value. Names are case-sensitive, start with a letter or underscore, and contain letters, numbers, or underscores, up to 64 characters. Each environment supports 50 secrets; a value is a non-empty string of up to 8 KiB.

Values are encrypted and never shown again in settings. Replace a value to rotate it without redeploying works. Deleting a secret can break works that need it. Refresh if another person changed the secret while you were editing it.

Read a value inside a work

Read a credential
const apiKey = await secrets.get("EMAIL_API_KEY");

Secrets belong to store + environment and are available to every work and group in that environment. No manifest declaration is required. get returns the string or throws SECRET_NOT_FOUND; it never falls back to the other environment. A run keeps the first value it reads for a given name. Replacement and deletion apply to new reads in later runs; an in-progress run may still hold the previous value.

Guide the merchant without handling the value

get_context.secrets lists names, environments, and timestamps, plus a manageUrl for this store. Explain which key is needed, where to obtain it, and its minimum required provider permissions. Send the merchant to that URL to enter it. Call get_context again to check availability. Never ask them to paste the value into chat, source, a manifest, or a document. There is no management tool that reveals secret values; an agent with code-deployment access can nevertheless write code that reads them.

Avoid exposing credentials

A value read through secrets.get is registered with the SDK and trusted backend redaction filters before it is returned to the work. Exact occurrences are replaced in captured logs and errors, including nested values and free text. This helps prevent accidental leaks; encoding, splitting, or transforming a value can evade matching. Never log a secret, put it in an error, return it to a caller, or save it in a collection. Outputs and stored documents are not automatically redacted.

Use the value with External requests. Shopify credentials remain managed by Littleworks; use shopify.graphql and the granted Shopify permissions.