Authentication

Every request to Stewi’s API must include an API key in the Authorization header:

Authorization: Bearer <STEW_API_KEY>

Keys are scoped to an organization. Rotate them from Settings → Access Tokens. Keys never expire automatically; revoke them immediately if they leak.

Signing Outbound Webhooks

Stewi verifies Merge.dev payloads with a shared secret. Configure the secret in both Merge and Stewi, then include it when you call the /api/webhooks/merge endpoint locally (see merge-webhook).

Signature Header

X-Merge-Signature: t=<unix>,v1=<hex-hmac>

• t is the request’s Unix timestamp (seconds).
• v1 is the hex-encoded HMAC-SHA256 signature generated from the raw body.

Requests more than five minutes skewed from the server clock are rejected.