Managing the client ID and client secret
Explains how to obtain the client ID and client secret issued when you register a ReceiptRoller app, storage rules, what to do on a leak, and operating across multiple environments.
Rotating and safely storing secrets
Explains the rotation plan for safely operating ReceiptRoller client secrets and Webhook secrets, how to use the old/new parallel period, and best practices for storage.
What is application registration
Explains the concept of ReceiptRoller application registration. Registering an app as an OAuth client issues a client ID, secret, and redirect URI, letting you start API and Webhook integrations.
Signature verification and security
Explains how ReceiptRoller Webhook HMAC-SHA256 signature verification works, sample verification code (Node.js / Python / C#), replay-attack countermeasures, and how to manage secrets safely.
Store-facing: Guide to Issuing Digital Receipts from Your Own App and Getting Webhook Notifications
Explains how a store or brand issues digital receipts to customers from its own app and receives real-time notifications via Webhooks. Covers app registration, OAuth, Webhook setup, and signature verification.
How to register a Webhook
Explains how to register a Webhook endpoint in the ReceiptRoller developer portal, how to choose subscribed events, test delivery, using multiple endpoints, and how to delete or pause an endpoint.
Cannot obtain a token (authentication error)
How to isolate the cause when you cannot obtain an access token. Explains the representative errors — invalid_client, invalid_grant, redirect_uri_mismatch — and what to do about them.
Creating a new app
Explains the concrete steps to register a new app (OAuth client) in the ReceiptRoller developer portal. Covers the input fields, validation, the post-creation credentials display, and common errors.
The flow to getting started
Explains the flow to start using the ReceiptRoller developer portal. If you register as a store user and are on the Starter plan or higher, no separate developer application is needed; you can register an app and begin API implementation right away.
Developer Help Index
The index of ReceiptRoller developer help. Covers the developer application, app registration, OAuth authentication and scopes, implementation guides (wallet apps, store-facing Webhooks, the Survey API), guides by data domain, operations and security, the community, and troubleshooting.
Access control and audit logs
Explains how to design access control for operating a ReceiptRoller integration app, the principle of least privilege, how to take audit logs, and how to run periodic reviews.
Obtaining and refreshing an access token
Explains how to obtain the access token and refresh token used with the ReceiptRoller API, their expiry, the refresh procedure, and what to do on errors.
Setting the redirect URL
Explains the role of the redirect URI (callback URL) you set in the ReceiptRoller developer portal, the registration rules, using development vs. production environments, and common errors and how to handle them.
Contacting support (technical integration)
Explains the types of support available to ReceiptRoller developers, a checklist to run before contacting support, and a template of the information to attach so issues get resolved efficiently.
Monitoring and handling failures
Explains how to read the ReceiptRoller Webhook delivery history, the metrics to monitor and how to design alerts, redelivering dead letters, and common failure patterns and recovery procedures.
How to think about data protection (anonymization and encryption)
Explains how to think about data protection in a ReceiptRoller integration app — encryption (at rest and in transit), anonymization and pseudonymization techniques, and a deletion policy.
Wallet App: Guide to Fetching a User's Receipts via OAuth
Explains how to fetch a user's Receipt Roller purchase receipts, with their consent, from a wallet-style app such as iOS, Android, or a LINE Mini App. Covers OAuth 2.0 authentication, the receipts API, and Webhook integration.
Best practices for production operation
Explains best practices for running a ReceiptRoller integration app in production — environment separation, monitoring, deployment, incident response, and keeping documentation in order.
403/401 is returned (permissions and scopes)
How to isolate the cause when an API call returns 401 or 403. Explains the typical cases: invalid token, insufficient scope, no store access permission, and User-scope review not passed.
What You Can Do with the Developer Portal
An overview of what the ReceiptRoller developer portal lets you do. Combine data retrieval and operations via the REST API with real-time event delivery via Webhooks to connect store and user data from external systems.