Signature verification and security
Explains how ReceiptRoller Webhook HMAC-SHA256 signature verification works, sample verification code (Node.js / Python / C#), replay-attack countermeasures, and how to manage secrets safely.
Developer Help Index
The index of ReceiptRoller developer help. Covers the developer application, app registration, OAuth authentication and scopes, implementation guides (wallet apps, store-facing Webhooks, the Survey API), guides by data domain, operations and security, the community, and troubleshooting.
SNS Webhook bypass (forwarding Webhooks from external SNS such as LINE)
Explains the mechanism, setup, signature handling, and cautions of the "SNS Webhook bypass" feature, which forwards Webhooks ReceiptRoller receives from SNS platforms such as LINE to a developer app, with the store's consent.
Webhook is not being delivered
How to isolate the cause when a Webhook does not reach your receiving endpoint. Walks through checking, in order, the endpoint settings, subscribed events, reachability, signature-verification failures, and firewalls.
Rotating and safely storing secrets
Explains the rotation plan for safely operating ReceiptRoller client secrets and Webhook secrets, how to use the old/new parallel period, and best practices for storage.
How to read the API reference and docs
Explains the structure of ReceiptRoller's developer documentation and when to use each part. Covers the four entry points — the developer help, the API top page, the Swagger-based API reference, and the developer community — and how to obtain the OpenAPI spec (openapi/v1.json) for use with AI assistants and code generators.
How to register a Webhook
Explains how to register a Webhook endpoint in the ReceiptRoller developer portal, how to choose subscribed events, test delivery, using multiple endpoints, and how to delete or pause an endpoint.
Monitoring and handling failures
Explains how to read the ReceiptRoller Webhook delivery history, the metrics to monitor and how to design alerts, redelivering dead letters, and common failure patterns and recovery procedures.
Wallet App: Guide to Fetching a User's Receipts via OAuth
Explains how to fetch a user's Receipt Roller purchase receipts, with their consent, from a wallet-style app such as iOS, Android, or a LINE Mini App. Covers OAuth 2.0 authentication, the receipts API, and Webhook integration.
Webhook overview
Explains the main event types delivered by ReceiptRoller Webhooks, why to use Webhooks instead of polling, the delivery format (HTTPS POST + JSON), and how to think about delivery guarantees.
Designing resends, ordering, and idempotency
Explains ReceiptRoller's Webhook resend policy, why delivery order is not guaranteed, implementing idempotency with event_id, handling dead letters, and common anti-patterns.
Listing business accounts, stores, and POS terminals
A guide to retrieving, via REST API, the business accounts a user belongs to, the stores under them, and each store's POS terminals, from a ReceiptRoller mobile app or server integration.
Guide for native mobile apps: multi-business-account access and the OAuth flow
An implementation guide for Android / iOS native apps. Turning off "bind the token to one business account at authorization time" during app registration issues a user-scoped OAuth token. With the /api/v1/me/organizations + ?organizationId= pattern, you can access multiple business accounts across the board.
Using the in-store media display API (Display API)
An overview of ReceiptRoller's in-store Android display API (/api/v1/displays/*) and the steps for pairing, heartbeat, playlist retrieval, and impression reporting. An introductory guide for building an app that plays a media loop on an Android kiosk or in-store signage device.
API Authentication Guide
Explains how to authenticate with the ReceiptRoller API using the OAuth 2.0 authorization code flow.
OAuth Scopes Reference and Availability
A reference of all scopes available in the ReceiptRoller OAuth API and which kinds of apps each scope can be granted to. Also covers the review requirement for User scopes, why Store and User scopes can't be mixed, and how to use the API from a LIFF app.