API keys

API keys authenticate Standard and Enhanced integrations. Send the key as a bearer token:

POST /v1/offers HTTP/1.1
Host: api.getphew.com
Authorization: Bearer sk_live_51Hc...
Content-Type: application/json

Key types

Prefix	Type	Where it may be used
sk_test_	Secret key, sandbox	Your servers
sk_live_	Secret key, live	Your servers
rk_test_, rk_live_	Restricted key, limited to chosen scopes	Your servers
pk_test_, pk_live_	Publishable key for the drop-in SDK. Can only create offers, from your registered domains	Browsers and apps

The prefix tells you the mode at a glance and makes keys easy to detect with secret scanners. Live keys are only issued after the go-live checklist.

Never expose secret keys

Secret and restricted keys must stay on your servers. If a key is committed to a repository, pasted into a ticket or sent to a browser, rotate it immediately and let us know.

Restricted keys

A restricted key carries only the scopes you pick. Use a separate key for each system so a compromise in one doesn’t expose the others.

Scope	Allows
offers:write	Create offers
policies:read	Read and list policies
policies:write	Create policies
policies:cancel	Cancel policies
claims:read	Read and list claims
merchants:write	Create and update merchants (Partner API)
settlements:read	Read settlement statements
webhooks:manage	Create, update and delete webhook endpoints

A request without the required scope gets 403 insufficient_scope.

Storage

• Keep keys in a secrets manager (for example AWS Secrets Manager, Google Secret Manager, Azure Key Vault or HashiCorp Vault), and load them into memory at runtime.
• Don’t log them. Phew never logs full keys either; only the last four characters appear in our logs.
• Phew stores only a hash of each secret key. We can’t show you a key again after it’s issued.

Rotation

Rotation has an overlap period so you can switch without downtime:

1. Ask us for a new key. The old key keeps working for the overlap period you choose (up to 7 days).
2. Deploy the new key.
3. Confirm traffic has moved (every response includes the key’s last four characters in Phew-Key-Hint).
4. Revoke the old key, or let it expire.

In an emergency we revoke a key immediately, with no overlap.