Rotating and safely storing secrets
Explains the rotation plan for safely operating ReceiptRoller client secrets and Webhook secrets, how to use the old/new parallel period, and best practices for storage.
Developer Help Index
The index of ReceiptRoller developer help. Covers the developer application, app registration, OAuth authentication and scopes, implementation guides (wallet apps, store-facing Webhooks, the Survey API), guides by data domain, operations and security, the community, and troubleshooting.
Access control and audit logs
Explains how to design access control for operating a ReceiptRoller integration app, the principle of least privilege, how to take audit logs, and how to run periodic reviews.
What is application registration
Explains the concept of ReceiptRoller application registration. Registering an app as an OAuth client issues a client ID, secret, and redirect URI, letting you start API and Webhook integrations.
Managing the client ID and client secret
Explains how to obtain the client ID and client secret issued when you register a ReceiptRoller app, storage rules, what to do on a leak, and operating across multiple environments.
Obtaining and refreshing an access token
Explains how to obtain the access token and refresh token used with the ReceiptRoller API, their expiry, the refresh procedure, and what to do on errors.
Monitoring and handling failures
Explains how to read the ReceiptRoller Webhook delivery history, the metrics to monitor and how to design alerts, redelivering dead letters, and common failure patterns and recovery procedures.
Creating a new app
Explains the concrete steps to register a new app (OAuth client) in the ReceiptRoller developer portal. Covers the input fields, validation, the post-creation credentials display, and common errors.
Guide for native mobile apps: multi-business-account access and the OAuth flow
An implementation guide for Android / iOS native apps. Turning off "bind the token to one business account at authorization time" during app registration issues a user-scoped OAuth token. With the /api/v1/me/organizations + ?organizationId= pattern, you can access multiple business accounts across the board.
Signature verification and security
Explains how ReceiptRoller Webhook HMAC-SHA256 signature verification works, sample verification code (Node.js / Python / C#), replay-attack countermeasures, and how to manage secrets safely.