curl -sS "https://phosra-api-sandbox-production.up.railway.app/api/v1/developers/orgs/org_01HXV2K8Z3QJ5N6P7R8S9T0U1V/keys" \
-H "Authorization: Bearer $PHOSRA_SESSION_TOKEN"
const BASE = "https://phosra-api-sandbox-production.up.railway.app/api/v1";
const res = await fetch(`${BASE}/developers/orgs/org_01HXV2K8Z3QJ5N6P7R8S9T0U1V/keys`, {
headers: {
"Authorization": `Bearer ${process.env.PHOSRA_SESSION_TOKEN}`,
},
});
console.log(res.status, await res.json());
import os, requests
BASE = "https://phosra-api-sandbox-production.up.railway.app/api/v1"
res = requests.get(
f"{BASE}/developers/orgs/org_01HXV2K8Z3QJ5N6P7R8S9T0U1V/keys",
headers={"Authorization": f"Bearer {os.environ['PHOSRA_SESSION_TOKEN']}"},
)
print(res.status_code, res.json())
package main
import (
"fmt"
"io"
"net/http"
"os"
)
func main() {
base := "https://phosra-api-sandbox-production.up.railway.app/api/v1"
req, _ := http.NewRequest("GET", base+"/developers/orgs/org_01HXV2K8Z3QJ5N6P7R8S9T0U1V/keys", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("PHOSRA_SESSION_TOKEN"))
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(resp.Status, string(out))
}
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://phosra-api-sandbox-production.up.railway.app/api/v1/developers/orgs/{orgId}/keys",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}HttpResponse<String> response = Unirest.get("https://phosra-api-sandbox-production.up.railway.app/api/v1/developers/orgs/{orgId}/keys")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://phosra-api-sandbox-production.up.railway.app/api/v1/developers/orgs/{orgId}/keys")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "6e40f3da-d4e8-4be0-87c6-a33e803adafc",
"org_id": "ef35953a-44f5-473a-a86f-1341163fa40e",
"name": "f1-key2",
"key_prefix": "phosra_live_b4e5cb24",
"environment": "live",
"scopes": [],
"created_by": "06c5090f-ea5b-4841-a611-e8c9d67df0c5",
"created_at": "2026-07-03T10:47:35.107215Z"
}
]{
"error": "Bad Request",
"message": "invalid org ID",
"code": 400
}{
"error": "Unauthorized",
"message": "missing authorization header",
"code": 401
}{
"error": "Forbidden",
"message": "not a member of this organization",
"code": 403
}{
"error": "Not Found",
"message": "developer org not found",
"code": 404
}{
"error": "Too Many Requests",
"message": "rate limit exceeded",
"code": 429
}{
"error": "Internal Server Error",
"message": "internal error",
"code": 500
}List API keys
Returns the API keys for a developer organization. Only key metadata is returned; the secret is shown once, at creation.
curl -sS "https://phosra-api-sandbox-production.up.railway.app/api/v1/developers/orgs/org_01HXV2K8Z3QJ5N6P7R8S9T0U1V/keys" \
-H "Authorization: Bearer $PHOSRA_SESSION_TOKEN"
const BASE = "https://phosra-api-sandbox-production.up.railway.app/api/v1";
const res = await fetch(`${BASE}/developers/orgs/org_01HXV2K8Z3QJ5N6P7R8S9T0U1V/keys`, {
headers: {
"Authorization": `Bearer ${process.env.PHOSRA_SESSION_TOKEN}`,
},
});
console.log(res.status, await res.json());
import os, requests
BASE = "https://phosra-api-sandbox-production.up.railway.app/api/v1"
res = requests.get(
f"{BASE}/developers/orgs/org_01HXV2K8Z3QJ5N6P7R8S9T0U1V/keys",
headers={"Authorization": f"Bearer {os.environ['PHOSRA_SESSION_TOKEN']}"},
)
print(res.status_code, res.json())
package main
import (
"fmt"
"io"
"net/http"
"os"
)
func main() {
base := "https://phosra-api-sandbox-production.up.railway.app/api/v1"
req, _ := http.NewRequest("GET", base+"/developers/orgs/org_01HXV2K8Z3QJ5N6P7R8S9T0U1V/keys", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("PHOSRA_SESSION_TOKEN"))
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(resp.Status, string(out))
}
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://phosra-api-sandbox-production.up.railway.app/api/v1/developers/orgs/{orgId}/keys",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}HttpResponse<String> response = Unirest.get("https://phosra-api-sandbox-production.up.railway.app/api/v1/developers/orgs/{orgId}/keys")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://phosra-api-sandbox-production.up.railway.app/api/v1/developers/orgs/{orgId}/keys")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "6e40f3da-d4e8-4be0-87c6-a33e803adafc",
"org_id": "ef35953a-44f5-473a-a86f-1341163fa40e",
"name": "f1-key2",
"key_prefix": "phosra_live_b4e5cb24",
"environment": "live",
"scopes": [],
"created_by": "06c5090f-ea5b-4841-a611-e8c9d67df0c5",
"created_at": "2026-07-03T10:47:35.107215Z"
}
]{
"error": "Bad Request",
"message": "invalid org ID",
"code": 400
}{
"error": "Unauthorized",
"message": "missing authorization header",
"code": 401
}{
"error": "Forbidden",
"message": "not a member of this organization",
"code": 403
}{
"error": "Not Found",
"message": "developer org not found",
"code": 404
}{
"error": "Too Many Requests",
"message": "rate limit exceeded",
"code": 429
}{
"error": "Internal Server Error",
"message": "internal error",
"code": 500
}Authorizations
A logged-in user session bearer token (WorkOS AuthKit access token from signup/login).
Path Parameters
UUID of the developer organization.
Response
Array of API keys (secrets are never included in list responses).
Unique identifier for this resource.
UUID identifier.
Human-readable display name.
Key prefix.
One of: test, live.
test, live Permission scopes granted to this key; empty means unscoped (full access within the account).
RFC 3339 timestamp.
IP address of the most recent request made with this key; null if never used.
RFC 3339 timestamp of when this value expires.
RFC 3339 timestamp of when the key was revoked; null while the key is active.
UUID identifier.
RFC 3339 timestamp of when the resource was created.