Access control and audit logs
Explains how to design access control for operating a ReceiptRoller integration app, the principle of least privilege, how to take audit logs, and how to run periodic reviews.
Obtaining and refreshing an access token
Explains how to obtain the access token and refresh token used with the ReceiptRoller API, their expiry, the refresh procedure, and what to do on errors.
Guide for native mobile apps: multi-business-account access and the OAuth flow
An implementation guide for Android / iOS native apps. Turning off "bind the token to one business account at authorization time" during app registration issues a user-scoped OAuth token. With the /api/v1/me/organizations + ?organizationId= pattern, you can access multiple business accounts across the board.
Cannot obtain a token (authentication error)
How to isolate the cause when you cannot obtain an access token. Explains the representative errors — invalid_client, invalid_grant, redirect_uri_mismatch — and what to do about them.
How to think about data protection (anonymization and encryption)
Explains how to think about data protection in a ReceiptRoller integration app — encryption (at rest and in transit), anonymization and pseudonymization techniques, and a deletion policy.
403/401 is returned (permissions and scopes)
How to isolate the cause when an API call returns 401 or 403. Explains the typical cases: invalid token, insufficient scope, no store access permission, and User-scope review not passed.
Best practices for production operation
Explains best practices for running a ReceiptRoller integration app in production — environment separation, monitoring, deployment, incident response, and keeping documentation in order.
Developer Help Index
The index of ReceiptRoller developer help. Covers the developer application, app registration, OAuth authentication and scopes, implementation guides (wallet apps, store-facing Webhooks, the Survey API), guides by data domain, operations and security, the community, and troubleshooting.
Applying for review of User-scopes
For apps that handle general consumers' data (user.* scopes) on ReceiptRoller, this explains the review application flow, the documents to submit, the review criteria, the review period, and common reasons for rejection.
Managing the client ID and client secret
Explains how to obtain the client ID and client secret issued when you register a ReceiptRoller app, storage rules, what to do on a leak, and operating across multiple environments.
Rotating and safely storing secrets
Explains the rotation plan for safely operating ReceiptRoller client secrets and Webhook secrets, how to use the old/new parallel period, and best practices for storage.
API Authentication Guide
Explains how to authenticate with the ReceiptRoller API using the OAuth 2.0 authorization code flow.
Signature verification and security
Explains how ReceiptRoller Webhook HMAC-SHA256 signature verification works, sample verification code (Node.js / Python / C#), replay-attack countermeasures, and how to manage secrets safely.
Using the Orders / OMS API
A guide to CRUD operations on the orders under a business account using ReceiptRoller's Orders / OMS API (/api/v1/orders). Covers creating, updating, transitioning status (confirm, process, cancel), and deleting orders, plus the flow for Android / iOS apps and server integrations.
Using the Products API
A guide to CRUD operations on products under a business account using the ReceiptRoller Products API (/api/v1/products). An introductory article for reading and writing the PIM (product master) from an Android/iOS app or server integration.
Wallet App: Guide to Fetching a User's Receipts via OAuth
Explains how to fetch a user's Receipt Roller purchase receipts, with their consent, from a wallet-style app such as iOS, Android, or a LINE Mini App. Covers OAuth 2.0 authentication, the receipts API, and Webhook integration.
Store-facing: Guide to Issuing Digital Receipts from Your Own App and Getting Webhook Notifications
Explains how a store or brand issues digital receipts to customers from its own app and receives real-time notifications via Webhooks. Covers app registration, OAuth, Webhook setup, and signature verification.
Using the Sales API
An overview of ReceiptRoller's Sales API (/api/v1/sales/*) and how to filter by business account, store, POS terminal, and period. A getting-started guide covering the actual response structure (the KpiValue nested type) through averageTicket and the 8-hour token lifetime, for building a sales dashboard in an Android/iOS mobile app or server integration.
OAuth Scopes Reference and Availability
A reference of all scopes available in the ReceiptRoller OAuth API and which kinds of apps each scope can be granted to. Also covers the review requirement for User scopes, why Store and User scopes can't be mixed, and how to use the API from a LIFF app.
Listing business accounts, stores, and POS terminals
A guide to retrieving, via REST API, the business accounts a user belongs to, the stores under them, and each store's POS terminals, from a ReceiptRoller mobile app or server integration.