Best practices for production operation
Explains best practices for running a ReceiptRoller integration app in production — environment separation, monitoring, deployment, incident response, and keeping documentation in order.
Managing the client ID and client secret
Where to find the client ID and client secret, how to store them, regenerating the secret after a suspected leak, and running several environments.
app_not_approved is returned for User-scope calls
What to check when using a User-scope results in an app_not_approved error. Explains development with a sandbox slot, applying for review, and the flow from sandbox to production.
Setting the redirect URL
The role of the single redirect URI on a developer app, the exact-match rule, separating environments, changing it, and common errors.
Applying for review of User-scopes
For apps that handle general consumers' data (user.* scopes) on ReceiptRoller, this explains the review application flow, the documents to submit, the review criteria, the review period, and common reasons for rejection.
Cannot obtain a token (authentication error)
How to narrow down a 400 or 401 from the token endpoint, with the fix for each error and error_description, including invalid_client and invalid_grant.
Creating a new app
How to register a developer app in a business account: the fields, how the credentials are shown, what you can do afterwards, and common stumbling points.
Signature verification and security
How X-RR-Signature is computed, verification code for Node.js, Python and C#, guarding against replays, and how to replace a webhook secret.
Receive new sales by webhook and post them to Slack
Register a receipt.created webhook, verify its signature and drop duplicates in Node.js, and post each new sale to a Slack channel.