OAuth Scopes Reference and Availability
This page lists every scope you can specify with the ReceiptRoller OAuth API, along with which kinds of apps each scope can be granted to. Read it before you register an OAuth app or build an authorization URL.
OAuth Scopes Reference and Availability
Access to the ReceiptRoller API is controlled by OAuth 2.0 scopes. When you register an app and when you send a user to the authorization screen, request only the minimum set of scopes you actually need. Multiple scopes are specified as a space-separated list.
Scope Categories
Scopes are grouped into four categories by purpose.
- Store — business data for a store or business account (products, orders, inventory, reservations, staff, and more)
- CRM — customer profiles and segment information
- SNS / Analytics — SNS posts, audience, analytics, and sales reports
- User (consumer) — an individual user's receipts, spending, favorite stores, and so on
As explained below, User scopes are strict scopes granted only to first-party apps and approved partners as a rule.
Store Scopes
These scopes let a store owner or business account administrator operate on their own store data via OAuth. They can also be granted to external partner apps, but the store must authorize them on the OAuth consent screen.
| Scope | Permission granted |
|---|---|
store.products.read | Read product and inventory information |
store.products.write | Create and update products |
store.orders.read | Read order data |
store.orders.write | Update order status |
store.customers.read | Read customer data |
store.customers.write | Create, update, and delete customers |
store.coupons.read | Read coupon data |
store.coupons.write | Create and update coupons |
store.inventory.read | Read warehouse and stock data |
store.inventory.write | Adjust stock levels and apply stocktake results |
store.flyers.read | Read store flyers |
store.flyers.write | Create, update, and publish store flyers |
store.staff.read | Read employee and staff information |
store.staff.write | Create, update, and delete employees |
store.business-hours.read | Read business hours, special business days, and available working hours |
store.business-hours.write | Update business hours, special business days, and available working hours |
store.reservations.read | Read reservations, reservation slots, and seat information |
store.reservations.write | Create and change reservations, update their status, and generate reservation slots |
store.info.read | Read a store's basic information (name, contact, address) |
store.info.write | Update a store's basic information (name, contact, address) |
CRM Scopes
| Scope | Permission granted |
|---|---|
crm.profiles.read | Read CRM customer profiles |
crm.segments.read | Read CRM segments and lists |
SNS / Analytics Scopes
| Scope | Permission granted |
|---|---|
sns.content.read | Read SNS post data |
sns.content.write | Create, update, publish, schedule, and delete SNS posts |
sns.audience.read | Read SNS audience data |
analytics.read | Read analytics snapshots |
sales.read | Read sales reports and transaction data, and business insights |
User (Consumer) Scopes
These scopes access a consumer's personal data — an individual user's receipts, spending, favorite stores, and so on. They are granted only to ReceiptRoller first-party apps and to explicitly approved partner apps.
If an unreviewed app requests
user.* scopes and calls the authorization URL, an app_not_approved error is returned.
| Scope | Permission granted |
|---|---|
user.profile.read | Read the user's basic information |
user.profile.write | Update the user's basic information |
user.receipts.read | Read the receipts the user has received |
user.spending.read | Read the monthly spending summary |
user.spending.write | Update spending and budget data |
user.coupons.read | Read coupons from favorite stores |
user.favorites.read | Read the list of favorite stores |
user.favorites.write | Add and remove favorite stores |
Important Constraints
1. User scopes are review-gated
If you include a user.* scope when registering an OAuth app, the app's UserScopeStatus becomes pending (awaiting review). Until the ReceiptRoller operations team reviews it and sets it to approved, specifying a user.* scope in the authorization flow returns an error.
An external store or partner wanting to "show a user all the receipts they've received, in our own LIFF app or mobile app" is subject to this review as a rule. Feel free to reach out to support.
2. Store and User scopes can't be mixed in the same authorization flow
You cannot specify store.orders.read and user.receipts.read together in a single authorization request. Because these involve different actors (store vs. user), the authorization server rejects the request.
If you're building a service that handles both kinds of data, register two OAuth apps and obtain tokens through separate authorization flows.
3. Principle of least privilege
To earn the trust of the user (or store owner), request only the scopes you genuinely need. We don't recommend "adding write just in case" or "requesting other scopes you won't use."
Recommended Scopes by Use Case
| What you want to do | Scopes needed | Notes |
|---|---|---|
| Sync a store's inventory and orders from an external system | store.products.read store.products.write store.orders.read |
Obtainable with the store owner's consent |
| Apply stock adjustments and stocktake results | store.inventory.read store.inventory.write |
Obtainable with the store owner's consent |
| Accept reservations from an external reservation system or mobile app | store.reservations.read store.reservations.write |
Obtainable with the store owner's consent |
| Handle staff and available working hours in a shift-management app | store.staff.read store.staff.write store.business-hours.read |
Obtainable with the store owner's consent |
| Update store information (name, contact, address) from a staff app or external system | store.info.read store.info.write |
Obtainable with the store owner's consent. Reading doesn't require granting it; updating requires store.info.write |
| Bulk-publish your store flyers from an internal CMS | store.flyers.write |
Obtainable with the store owner's consent |
| Feed CRM segments to a marketing team | crm.profiles.read crm.segments.read |
Obtainable with the store owner's consent |
| Embed a sales dashboard into your own tool | sales.read analytics.read |
Obtainable with the store owner's consent |
| Show a user all of their receipts in your own mobile app | user.receipts.read |
Prior review required |
| Visualize monthly spending in a household-budget app | user.spending.read user.receipts.read |
Prior review required |
| Fetch another company's store data via LIFF | — | Not possible (you can only obtain your own Store scopes) |
Using the API from LIFF / LINE Mini App
To call the ReceiptRoller API from a LIFF app (LINE Mini App), you also use the standard OAuth 2.0 authorization code flow.
Direct exchange of a LINE ID token is not provided
We currently don't provide an endpoint that directly exchanges a "LINE ID token → ReceiptRoller access token." A LIFF app, like any other web app, must send the user to the ReceiptRoller authorization screen.
Implementation pattern in LIFF
- After the LIFF app launches, initialize LIFF with
liff.init() - When you need the ReceiptRoller API, send the user to
/oauth/authorizevialiff.openWindow()or a regular link - When the user grants access on the ReceiptRoller authorization screen, an authorization code is returned to your
redirect_uri - Exchange the authorization code for an access token via
POST /api/v1/auth/token(grantType: authorization_code) - Send API requests with the token you obtained in the
Authorization: Bearerheader
Note when using User scopes
Even in a LIFF app, requesting user.* scopes requires the prior review described above. It is not designed so that "because the user is already authenticated in LINE, ReceiptRoller user authentication can be skipped." This is by design, for security and for transparency of user consent.
Related Guides
- Wallet app: guide to fetching a user's receipts via OAuth
- Store-facing: receipt issuance and Webhook notification guide
- Using the Store Information API
- Using the Reservations API
- Using the Business Hours API
- For technical questions or to apply for User scope review, contact support
-
The flow to getting startedExplains the flow to start using the ReceiptRoller developer portal. If you register as a store user and are on the Starter plan or higher, no separate developer application is needed; you can register an app and begin API implementation right away.
-
What is application registrationExplains the concept of ReceiptRoller application registration. Registering an app as an OAuth client issues a client ID, secret, and redirect URI, letting you start API and Webhook integrations.
-
Creating a new appExplains the concrete steps to register a new app (OAuth client) in the ReceiptRoller developer portal. Covers the input fields, validation, the post-creation credentials display, and common errors.
-
Wallet App: Guide to Fetching a User's Receipts via OAuthExplains how to fetch a user's Receipt Roller purchase receipts, with their consent, from a wallet-style app such as iOS, Android, or a LINE Mini App. Covers OAuth 2.0 authentication, the receipts API, and Webhook integration.