Download the PHP package yehia-tarek/salla-toolkit without Composer

Salla Laravel SDK

An unofficial Laravel package for building apps on the Salla e-commerce platform: Merchant API resources, OAuth 2.0 (Easy Mode & Custom Mode), and secure webhook handling. Built against docs.salla.dev.

This is a community package, not published or maintained by Salla. Endpoint paths mirror the Merchant API docs as of this writing — please verify against the docs for anything mission critical, and open an issue/PR if something drifted.

Features

• Fluent, resource-based client: Salla::orders()->all(), Salla::products()->create([...])
• OAuth 2.0 helpers for both Easy Mode and Custom Mode
• Per-store token storage (Eloquent model + migration) for multi-tenant apps, with automatic refresh-token exchange on expiry
• A secured webhook endpoint, auto-registered, that verifies Salla's signature and dispatches Laravel events per store event (order.created, product.created, etc.)
• Typed exceptions for auth failures, rate limits, and validation errors

Installation

salla:install publishes config/salla.php and the salla_authorizations migration, and prints your webhook URL.

Add your app's credentials (from the Salla Partners Portal) to .env:

Usage

Single-store / private apps

If you're building a private app for one store, drop a long-lived token in SALLA_ACCESS_TOKEN and skip straight to calling resources:

Public / multi-store apps (OAuth)

Easy Mode (recommended by Salla): send merchants straight to the install URL. Salla handles the authorization code exchange for you and delivers the resulting tokens via the app.store.authorize webhook event, which this package catches and persists automatically.

Nothing else required — as long as your webhook route is reachable and SALLA_WEBHOOK_SECRET matches the secret configured on the Partners Portal, tokens land in the salla_authorizations table on their own.

Custom Mode: build your own authorize URL and handle the callback:

Once a store's tokens are stored, scope every call to that store:

forStore() automatically refreshes the access token (and re-persists the new refresh token — Salla's are single-use) if a request comes back with a 401.

Ad-hoc token

Pagination

Salla list endpoints return data + pagination:

Or fetch every page at once (careful on large stores):

Available resources

orders, products, customers, categories, brands, coupons, specialOffers, shipments, shippingCompanies, shippingZones, taxes, countries, cities, currencies, affiliates, reviews, webhooks, settings, store, exports.

Every resource supports all(), find($id), create($data), update($id, $data), and delete($id) (where Salla's API supports the corresponding verb), plus resource-specific helpers — e.g. Salla::products()->findBySku($sku), Salla::orders()->updateStatus(...), Salla::customers()->ban($id). See each class under src/Resources for the full list.

Webhooks

Point your app's Webhook URL (Partners Portal) at:

(configurable via SALLA_WEBHOOK_PATH). Incoming requests are verified against X-Salla-Signature using SALLA_WEBHOOK_SECRET, then dispatched as Laravel events:

See the full event list at docs.salla.dev/421119m0.

If you'd rather not use the auto-registered route, set SALLA_WEBHOOK_ROUTE_ENABLED=false and wire up your own controller with the VerifySallaWebhook middleware:

Error handling

Custom token storage

Swap the Eloquent-backed repository for your own by binding the contract in your own service provider:

Your class just needs to implement store(), find(), and forget() — see src/Contracts/SallaTokenRepository.php.

Configuration reference

See config/salla.php for every option (API base URL, OAuth endpoints, HTTP timeouts/retries, token table name/connection, webhook path & middleware).

License

MIT