Access control and audit logs
Explains how to design access control for operating a ReceiptRoller integration app, the principle of least privilege, how to take audit logs, and how to run periodic reviews.
How to think about data protection (anonymization and encryption)
Explains how to think about data protection in a ReceiptRoller integration app — encryption (at rest and in transit), anonymization and pseudonymization techniques, and a deletion policy.
Rotating and safely storing secrets
Explains the rotation plan for safely operating ReceiptRoller client secrets and Webhook secrets, how to use the old/new parallel period, and best practices for storage.
What is application registration
Explains the concept of ReceiptRoller application registration. Registering an app as an OAuth client issues a client ID, secret, and redirect URI, letting you start API and Webhook integrations.
Applying for review of User-scopes
For apps that handle general consumers' data (user.* scopes) on ReceiptRoller, this explains the review application flow, the documents to submit, the review criteria, the review period, and common reasons for rejection.
OAuth Scopes Reference and Availability
A reference of all scopes available in the ReceiptRoller OAuth API and which kinds of apps each scope can be granted to. Also covers the review requirement for User scopes, why Store and User scopes can't be mixed, and how to use the API from a LIFF app.
SLA, uptime, and the checking procedure during an incident
Explains ReceiptRoller's API uptime targets, how to check the status page, the isolation procedure when an incident occurs, and the flow for escalating to support.
Endpoints and versioning
Explains the base URL of the ReceiptRoller API, the versioning policy, the deprecation-notice flow, and how to check the current version.
Webhook overview
Explains the main event types delivered by ReceiptRoller Webhooks, why to use Webhooks instead of polling, the delivery format (HTTPS POST + JSON), and how to think about delivery guarantees.
Signature verification and security
Explains how ReceiptRoller Webhook HMAC-SHA256 signature verification works, sample verification code (Node.js / Python / C#), replay-attack countermeasures, and how to manage secrets safely.
Designing resends, ordering, and idempotency
Explains ReceiptRoller's Webhook resend policy, why delivery order is not guaranteed, implementing idempotency with event_id, handling dead letters, and common anti-patterns.