Preview. The API is shared with design partners and may change before launch. Register interest for sandbox access.

API overview

Phew has two REST APIs that share the same conventions.

API	Base URL	For
Checkout API	`https://api.getphew.com/v1`	Offers, policies, claims, webhooks: everything around an order
Partner API	`https://partner-api.getphew.com/v1`	Merchants and settlements, for platforms and payment providers

Both accept and return JSON (Content-Type: application/json, UTF-8). Every request must use HTTPS.

Authentication

Send a secret key or an OAuth 2.0 access token as a bearer token:

Authorization: Bearer sk_test_51Hc...

The credential decides the mode: test keys and sandbox OAuth clients only see sandbox data. See API keys and OAuth 2.0 and mTLS.

Headers

Header	Direction	Purpose
`Authorization`	Request	Bearer credential
`Idempotency-Key`	Request	Safe retries for `POST`; see Idempotency
`Phew-Merchant`	Request	Partners acting for one of their merchants
`Phew-Version`	Request	Pin an API version, for example `2026-10-01`
`Content-Digest`, `Signature-Input`, `Signature`	Request	Signed requests
`X-Request-Id`	Response	Unique ID for the request; include it when contacting support
`RateLimit-*`	Response	See Rate limits

Conventions

IDs are strings with a type prefix: off_ offer, pol_ policy, clm_ claim, mer_ merchant, stm_ statement, whe_ webhook endpoint, evt_ event. Treat them as opaque; they’re up to 64 characters.
Amounts are integers in the currency’s minor unit: 8900 is 89.00 NOK.
Currencies are ISO 4217 codes (NOK, SEK, DKK, EUR). Markets are ISO 3166-1 alpha-2 codes.
Timestamps are RFC 3339 strings in UTC: 2026-10-23T13:42:09Z.
Field names are snake_case. Unknown request fields are rejected, so typos never pass silently.
Every object has an object field naming its type.
New fields may be added to responses at any time. Your code must ignore fields it doesn’t know.

Pagination

List endpoints return a page of results, newest first:

{
  "object": "list",
  "data": [{ "id": "pol_01JD7QB2...", "object": "policy" }],
  "has_more": true
}

Use limit (1 to 100, default 20) and pass the last ID you received as starting_after to get the next page.

curl "https://api.getphew.com/v1/policies?limit=50&starting_after=pol_01JD7QB2..." \
  -H "Authorization: Bearer $PHEW_KEY"

Versioning

The current version is 2026-10-01. Your account is pinned to the version current when you first make a request. Additive changes (new endpoints, new optional fields, new event types, new enum values) are not breaking and apply to all versions. Breaking changes get a new dated version; send Phew-Version to try one before upgrading.

Health

GET /health on each host returns 200 with the environment and the deployed release, and needs no authentication.