Signature verification and security
How X-RR-Signature is computed, verification code for Node.js, Python and C#, guarding against replays, and how to replace a webhook secret.
Developer Help Index
The index of ReceiptRoller developer help. Covers the developer application, app registration, OAuth authentication and scopes, implementation guides (wallet apps, store-facing Webhooks, the Survey API), guides by data domain, operations and security, the community, and troubleshooting.
Webhook is not being delivered
When a webhook does not arrive: narrow it down with a test send and the delivery log, then check the active flag, subscribed events, connection and signature.
How to register a Webhook
Register a webhook in the developer portal or through the API, choose events that are actually sent, run a test send, and change, pause or delete a webhook.
Designing resends, ordering, and idempotency
What counts as success, the retry rules (1 min, 10 min, 1 h, four attempts), ordering and lost events, and dropping duplicates by X-RR-Delivery.
Wallet App: Guide to Fetching a User's Receipts via OAuth
Explains how to fetch a user's Receipt Roller purchase receipts, with their consent, from a wallet-style app such as iOS, Android, or a LINE Mini App. Covers OAuth 2.0 authentication, the receipts API, and Webhook integration.
Monitoring and handling failures
Read a webhook's active flag, last delivery time and delivery log, notice when it has switched itself off, recover, and fill the gap from the API.
Webhook overview
Which webhook events are actually sent, what the request and signature headers look like, how duplicates, order and lost events behave, and when to use the API.
OAuth Scopes Reference and Availability
A reference of all scopes available in the ReceiptRoller OAuth API and which kinds of apps each scope can be granted to. Also covers the review requirement for User scopes, why Store and User scopes can't be mixed, and how to use the API from a LIFF app.
API Authentication Guide
How to authenticate with the OAuth 2.0 authorization code flow: authorize parameters, the consent screen, token exchange and revocation, errors and scopes.