cURL
curl -sS "https://phosra-api-sandbox-production.up.railway.app/api/v1/mcp-tokens" \
-H "Authorization: Bearer $PHOSRA_SESSION_TOKEN"const BASE = "https://phosra-api-sandbox-production.up.railway.app/api/v1";
const res = await fetch(`${BASE}/mcp-tokens`, {
headers: {
"Authorization": `Bearer ${process.env.PHOSRA_SESSION_TOKEN}`,
},
});
console.log(res.status, await res.json());
import os, requests
BASE = "https://phosra-api-sandbox-production.up.railway.app/api/v1"
res = requests.get(
f"{BASE}/mcp-tokens",
headers={"Authorization": f"Bearer {os.environ['PHOSRA_SESSION_TOKEN']}"},
)
print(res.status_code, res.json())
package main
import (
"fmt"
"io"
"net/http"
"os"
)
func main() {
base := "https://phosra-api-sandbox-production.up.railway.app/api/v1"
req, _ := http.NewRequest("GET", base+"/mcp-tokens", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("PHOSRA_SESSION_TOKEN"))
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(resp.Status, string(out))
}
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://phosra-api-sandbox-production.up.railway.app/api/v1/mcp-tokens",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}HttpResponse<String> response = Unirest.get("https://phosra-api-sandbox-production.up.railway.app/api/v1/mcp-tokens")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://phosra-api-sandbox-production.up.railway.app/api/v1/mcp-tokens")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"tokens": [
{
"id": "f456e4ac-d77c-411b-9061-88a7a1befc3b",
"user_id": "06c5090f-ea5b-4841-a611-e8c9d67df0c5",
"family_id": "63069024-1a49-4b95-80e8-f1b1b769355e",
"label": "Untitled",
"token_prefix": "phomcp_ZTFPEH7X",
"last_used_at": null,
"created_at": "2026-07-06T09:25:30Z",
"revoked_at": null
}
]
}{
"error": "Unauthorized",
"message": "auth required",
"code": 401
}{
"error": "Too Many Requests",
"message": "rate limit exceeded",
"code": 429
}{
"error": "Internal Server Error",
"message": "internal error",
"code": 500
}MCP Tokens
List MCP tokens
Returns the MCP tokens issued to the authenticated user. Only token metadata is returned, never the secret.
GET
/
mcp-tokens
cURL
curl -sS "https://phosra-api-sandbox-production.up.railway.app/api/v1/mcp-tokens" \
-H "Authorization: Bearer $PHOSRA_SESSION_TOKEN"const BASE = "https://phosra-api-sandbox-production.up.railway.app/api/v1";
const res = await fetch(`${BASE}/mcp-tokens`, {
headers: {
"Authorization": `Bearer ${process.env.PHOSRA_SESSION_TOKEN}`,
},
});
console.log(res.status, await res.json());
import os, requests
BASE = "https://phosra-api-sandbox-production.up.railway.app/api/v1"
res = requests.get(
f"{BASE}/mcp-tokens",
headers={"Authorization": f"Bearer {os.environ['PHOSRA_SESSION_TOKEN']}"},
)
print(res.status_code, res.json())
package main
import (
"fmt"
"io"
"net/http"
"os"
)
func main() {
base := "https://phosra-api-sandbox-production.up.railway.app/api/v1"
req, _ := http.NewRequest("GET", base+"/mcp-tokens", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("PHOSRA_SESSION_TOKEN"))
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
out, _ := io.ReadAll(resp.Body)
fmt.Println(resp.Status, string(out))
}
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://phosra-api-sandbox-production.up.railway.app/api/v1/mcp-tokens",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}HttpResponse<String> response = Unirest.get("https://phosra-api-sandbox-production.up.railway.app/api/v1/mcp-tokens")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://phosra-api-sandbox-production.up.railway.app/api/v1/mcp-tokens")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"tokens": [
{
"id": "f456e4ac-d77c-411b-9061-88a7a1befc3b",
"user_id": "06c5090f-ea5b-4841-a611-e8c9d67df0c5",
"family_id": "63069024-1a49-4b95-80e8-f1b1b769355e",
"label": "Untitled",
"token_prefix": "phomcp_ZTFPEH7X",
"last_used_at": null,
"created_at": "2026-07-06T09:25:30Z",
"revoked_at": null
}
]
}{
"error": "Unauthorized",
"message": "auth required",
"code": 401
}{
"error": "Too Many Requests",
"message": "rate limit exceeded",
"code": 429
}{
"error": "Internal Server Error",
"message": "internal error",
"code": 500
}Authorizations
A logged-in user session bearer token (WorkOS AuthKit access token from signup/login).
Response
Object wrapping the array of MCP tokens. NOTE: a user with no tokens gets {"tokens": null} (the array is null, not []) — verified live against the sandbox. A populated element is shown below.
Show child attributes
Show child attributes
⌘I