Managing the client ID and client secret
Explains how to obtain the client ID and client secret issued when you register a ReceiptRoller app, storage rules, what to do on a leak, and operating across multiple environments.
What is application registration
Explains the concept of ReceiptRoller application registration. Registering an app as an OAuth client issues a client ID, secret, and redirect URI, letting you start API and Webhook integrations.
Best practices for production operation
Explains best practices for running a ReceiptRoller integration app in production — environment separation, monitoring, deployment, incident response, and keeping documentation in order.
Using the Store App Content API (News, Pages, and Business Info)
A guide to /api/v1/apps/{shopId}/*, used to fetch store app content (news, pages, app manifest, business info, and membership card config). Explains that shopId is the same as the business account ID, the difference between business-account-level content and store-level content, and how authentication is handled.
How to think about data protection (anonymization and encryption)
Explains how to think about data protection in a ReceiptRoller integration app — encryption (at rest and in transit), anonymization and pseudonymization techniques, and a deletion policy.
SLA, uptime, and the checking procedure during an incident
Explains ReceiptRoller's API uptime targets, how to check the status page, the isolation procedure when an incident occurs, and the flow for escalating to support.
Access control and audit logs
Explains how to design access control for operating a ReceiptRoller integration app, the principle of least privilege, how to take audit logs, and how to run periodic reviews.