Access control and audit logs
Explains how to design access control for operating a ReceiptRoller integration app, the principle of least privilege, how to take audit logs, and how to run periodic reviews.
Obtaining and refreshing an access token
Explains how to obtain the access token and refresh token used with the ReceiptRoller API, their expiry, the refresh procedure, and what to do on errors.
Guide for native mobile apps: multi-business-account access and the OAuth flow
An implementation guide for Android / iOS native apps. Turning off "bind the token to one business account at authorization time" during app registration issues a user-scoped OAuth token. With the /api/v1/me/organizations + ?organizationId= pattern, you can access multiple business accounts across the board.
Cannot obtain a token (authentication error)
How to isolate the cause when you cannot obtain an access token. Explains the representative errors — invalid_client, invalid_grant, redirect_uri_mismatch — and what to do about them.
403/401 is returned (permissions and scopes)
How to isolate the cause when an API call returns 401 or 403. Explains the typical cases: invalid token, insufficient scope, no store access permission, and User-scope review not passed.