Preview. The API is shared with design partners and may change before launch. Register interest for sandbox access.
Security levels
Phew offers three security levels. They use the same endpoints and the same data, so moving up is a configuration change, not a rebuild. Your level is set per credential and per environment.
Comparison
Section titled “Comparison”| Standard | Enhanced | Bank-grade | |
|---|---|---|---|
| Best for | Webshops, small payment providers, pilots | Payment providers with stricter controls | Banks, large PSPs, regulated enterprises |
| Client authentication | Secret API key | Secret API key | private_key_jwt (RFC 7523) or mTLS (RFC 8705) |
| Credential on each request | API key | API key | 10-minute OAuth 2.0 access token |
| Token binding | Bound to the client certificate (mTLS) | ||
| Request integrity | TLS | TLS + RFC 9421 signature + Content-Digest |
TLS + RFC 9421 signature + Content-Digest |
| Network restriction | IP allowlist | IP allowlist | |
| Webhook signature | HMAC-SHA256 | HMAC-SHA256 or Ed25519 (RFC 9421) | Ed25519 (RFC 9421), keys as JWKS |
| Webhook transport | TLS | TLS | TLS, optionally mTLS |
| Key rotation | Manual, overlapping keys | Manual, overlapping keys | Automatic via your JWKS URL |
Standard API key
Section titled “Standard ”A secret API key in the Authorization header over TLS. Keys can be restricted to specific scopes and rotated with
an overlap period, so rotation never causes downtime. Webhooks are signed with HMAC-SHA256.
This is enough for most webshops and smaller providers, provided the key is held in a secrets manager on a server.
→ API keys
Enhanced Signed
Section titled “Enhanced ”Everything in Standard, plus:
- IP allowlist. Requests are only accepted from the IP ranges you register.
- Signed requests. Each request carries an HTTP Message Signature over the method, URL, body digest and key headers, made with your private key. A stolen API key alone can’t be used to call the API.
Bank-grade FAPI 2.0 aligned
Section titled “Bank-grade ”Designed around the FAPI 2.0 Security Profile used in open banking:
- No shared secrets. Clients authenticate with a private key, either as a signed JWT assertion
(
private_key_jwt) or a client certificate (mTLS). Phew never holds a secret that could impersonate you. - Short-lived, scoped tokens. Access tokens last 10 minutes and carry only the scopes the client was granted.
- Sender-constrained tokens. With mTLS, each token is bound to your certificate’s thumbprint (
cnf.x5t#S256); a leaked token is useless without the private key. - Signed messages both ways. Requests are signed with RFC 9421; webhooks are signed with Ed25519 keys that Phew publishes as a JWKS, so you can rotate without coordination.
- Optional mTLS for webhooks, so your endpoint only accepts connections from Phew’s client certificate.
- Operational commitments: a named security contact, a joint incident runbook and notification of security incidents affecting you without undue delay.