Access control and audit logs
Explains how to design access control for operating a ReceiptRoller integration app, the principle of least privilege, how to take audit logs, and how to run periodic reviews.
Applying for review of User-scopes
For apps that handle general consumers' data (user.* scopes) on ReceiptRoller, this explains the review application flow, the documents to submit, the review criteria, the review period, and common reasons for rejection.
OAuth Scopes Reference and Availability
A reference of all scopes available in the ReceiptRoller OAuth API and which kinds of apps each scope can be granted to. Also covers the review requirement for User scopes, why Store and User scopes can't be mixed, and how to use the API from a LIFF app.
How to register a Webhook
Register a webhook in the developer portal or through the API, choose events that are actually sent, run a test send, and change, pause or delete a webhook.
Designing resends, ordering, and idempotency
What counts as success, the retry rules (1 min, 10 min, 1 h, four attempts), ordering and lost events, and dropping duplicates by X-RR-Delivery.
Obtaining and refreshing an access token
How to obtain and refresh access tokens (8 hours) and refresh tokens (30 days), how refresh tokens rotate, and when tokens stop working.
Receive new sales by webhook and post them to Slack
Register a receipt.created webhook, verify its signature and drop duplicates in Node.js, and post each new sale to a Slack channel.