app_not_approved is returned for User-scope calls
When you call an API that uses a
user.* scope such as user.receipts.read, an app_not_approved error is returned.
Cause
Unless a User-scope has been approved through ReceiptRoller's review, it cannot be used by anyone other than test users inside the operating company. This happens when you try to authorize a general consumer, or when you use it with someone other than an approved test user.
Three cases
Case 1: In development, review not yet requested
What to do: Create a development app (a test app) and use the sandbox slot with test users inside the operating company (your own members). You cannot open the authorization flow to general consumers.
Case 2: Review in progress
What to do: You cannot use it with production users until the review is complete. You can check the review status in the developer portal → App → the "Scopes" tab.
Case 3: Approved, but failing for a specific user
What to do: That user may have revoked the app's authorization. Guide them to the re-authorization flow.
Checking procedure
- Developer portal → App → open the "Scopes" tab
- Check the status of the relevant
user.*scope- "Not requested" → an application is needed
- "Under review" → waiting for completion
- "Approved" → available in production
- "Rejected" → check the reason and re-apply
- If it fails even though it is "Approved", note the
request_idfrom the error response and the relevant user ID, and contact support
Developing with the sandbox slot
If you are a member (employee) of the operating company, you can try User-scopes even before review.
- Create a development app (a test app)
- Enable the "sandbox slot"
- Run the authorization flow as a member of the operating company
- API calls are now possible
This sandbox slot is limited to members inside the operating company only. It cannot be opened to external users or non-testers.
Moving to production
Once you have finished verifying behavior in the sandbox slot, you separately register a production app and apply for review. There is no mechanism to promote a sandbox app to production as-is.
Related guides
-
403/401 is returned (permissions and scopes)How to isolate the cause when an API call returns 401 or 403. Explains the typical cases: invalid token, insufficient scope, no store access permission, and User-scope review not passed.
-
The developer portal is not shown while on the Free planWhat to check when the ReceiptRoller developer portal is not shown. Explains what to do when your plan is Free, switching business accounts, and the timing of when the display updates.
-
Webhook is not being deliveredHow to isolate the cause when a Webhook does not reach your receiving endpoint. Walks through checking, in order, the endpoint settings, subscribed events, reachability, signature-verification failures, and firewalls.
-
Cannot obtain a token (authentication error)How to isolate the cause when you cannot obtain an access token. Explains the representative errors — invalid_client, invalid_grant, redirect_uri_mismatch — and what to do about them.