Announcing Changes to Receipt URL Permissions
We wanted to take a moment to update everyone on a change we made to improve the security of receipt URL links in Expensify.
Going forward, users can only view receipts if they have sufficient permissions needed to view receipt images via the receipt URL. This directly affects customers who share receipt URL links for invoicing or auditing purposes.
As of November 4, 2019, receipt URLs will only display receipt images to individuals with the required permissions. If you do not have the necessary permissions to view a receipt, you will receive a 403 error and the following message.
Permissions needed to view receipt images via URL
In order to view receipts via URL, you must meet at least one criterion from the list below.
You are the receipt owner
Be an auditor of the policy the receipt is submitted on
Be an admin of the policy the receipt is submitted on
The report submitter has shared the report with you
FAQ: I’m sharing receipt URLs with clients, how do I get them access to view the receipts now?
Sharing receipt images with others is an important functionality for many customers. To preserve the security of your expense information, it will now be necessary to ensure your client or auditor has access to the receipts in Expensify. You can do this in one of three ways.
Work with your IT department to grant the client or auditor an email they can use to access Expensify and the receipt images. This account will need a policy invite and the auditor role view receipt URL images.
If they already have an Expensify account, you can grant that account the necessary permissions to view receipt images. The account will need a policy invite and the auditor role at minimum to view receipt URL images.
If you don’t want to add them to your policy, you can ask them to create a free account using their email. Then, once this account exists, the report can be shared with them to grant them access to view receipt URL images.
A more manual alternative would be to download receipt images individually as needed by clicking the following button on an individual receipt: