Go-live checklist

Work through this list in sandbox before asking for live credentials. We review it with you on a short call.

Customer experience

• The offer shows the plan, term, price including taxes, and links to the terms and the IPID.
• The offer is not pre-selected, and declining takes no more effort than accepting.
• Cover appears as a separate line in the order confirmation and on the receipt.
• The offer only appears for items marked eligible: true.
• If Phew is unavailable, checkout continues without the offer.

Integration

• Policies are created only after payment succeeds.
• POST /v1/policies uses an Idempotency-Key derived from the order, and is retried on network errors and 5xx.
• Refunds and cancellations of covered items cancel the matching policy.
• Your webhook receiver verifies signatures, rejects old timestamps, and handles duplicate events.
• You log the request_id of every Phew response.

Security

• Secret keys and private keys are stored in a secrets manager, not in code or config files.
• Secret keys are never sent to browsers or mobile apps.
• Each credential has only the scopes it needs.
• You have a documented process to rotate keys and certificates.
• For Enhanced and Bank-grade: your egress IP ranges are registered and request signing passes in sandbox.
• For Bank-grade: your OAuth client, signing keys (JWKS URL or uploaded public keys) and client certificates are registered for the live environment.
• You have given us a security contact for incident notifications.

Operations

• Someone on your team is subscribed to status updates.
• Support staff know that customers claim directly with Phew, and where to send them.
• Finance knows how to read the monthly statement.

When everything is ticked, email partners@getphew.com and we’ll issue live credentials.