Skip to main content
“Phosra Developer SDK” is not a single npm package — it is the small set of published TypeScript packages you compose to build on the Phosra platform. There are two clearly-separated halves:
  • a management client for the Phosra control-plane REST API — @phosra/sdk, and
  • the OCSS protocol surface — @openchildsafety/ocss, the open standard’s vendor-neutral reference library, which Phosra re-exports and builds on without modification.
Looking for a single @phosra/sdk-dev “unified wrapper” package? It is not published — it is a planned convenience layer, not a shipping API. See Roadmap: the unified wrapper at the bottom. Everything you need ships today as the packages below.

Phosra follows OCSS; it does not own it

Phosra is an accredited provider on the Open Child Safety Specification (OCSS). The relationship is the same as Yubico shipping a FIDO2-conformant authentication key: Yubico implements FIDO2; the FIDO Alliance owns the standard. Phosra implements OCSS; the OCSS stewardship body owns the standard. The consequence for these SDKs: the protocol signing and verification primitives you get from @openchildsafety/ocss are not Phosra code — they are the vendor-neutral OCSS library. Phosra adds zero cryptographic logic to the protocol surface. If you later integrate a different OCSS-conformant provider, that protocol library is identical across all of them.

Installation

Every package below is published to npm today. Versions were verified against the live npm registry (npm view <pkg> version): Install just the ones you need. For a typical developer integration — management calls plus receipt verification:
@openchildsafety/ocss is intentionally a separate install rather than a bundled dependency, so you can pin the OCSS protocol version independently of the Phosra management client.

Using @phosra/sdk (the management client)

@phosra/sdk exports one class, PhosraClient. Construct it with a credential and (for the sandbox) a baseUrl, then reach the data plane through resource namespaces:
Credential → header mapping (precedence deviceKey > apiKey > accessToken): baseUrl defaults to https://prodapi.phosra.com/api/v1; override it for the sandbox (above) or http://localhost:8080/api/v1 for local dev.

Family → child → policy → rule

Or the one-step onboarding helper. setup.quick takes a QuickSetupRequest — two required fields plus three optional ones:
strictness accepts exactly "relaxed", "recommended", or "strict" (the Go Strictness enum in internal/service/setup.go); any other value is rejected. Omit it to get "recommended". Pass family_id or family_name (or neither — a family is auto-created), never rely on both.
X-Api-Key authenticates the Phosra control-plane data plane (families/children/policies/rules) — the platform’s own store. It does not authenticate an OCSS census verb (a signed rule write, enforcement confirmation, harm-context, or consent attestation): those are RFC-9421 DID-signed only. If you need signed census writes, use @phosra/link (provider side) / @phosra/gatekeeper (platform side), not this management client. See Authentication.
Resource namespaces on PhosraClient: auth, families, children, members, policies, rules, enforcement, platforms, compliance, webhooks, ratings, standards, setup, devices, reports, sources. All types (Family, Child, ChildPolicy, PolicyRule, RuleCategory, …) and error classes (PhosraApiError, PhosraAuthError, …) are re-exported from the package root. For the full typed walkthrough — every namespace, the cURL/Python/Go equivalents, and a live-verified sandbox run — see the TypeScript SDK page.

The OCSS protocol half: @openchildsafety/ocss

The protocol primitives are not Phosra code — @openchildsafety/ocss is the open standard’s reference TypeScript implementation, published vendor-neutrally. It covers:
  • Receipt signing and verification — sign and verify OCSS write receipts against the Trust Framework.
  • Sealed envelopes — router-blind sealed payloads (the harm_context lane).
  • Vocabulary, canon, and checksums — OCSS rule vocabulary, canonical JSON serialization, family hash derivation.
  • Trust list — resolve and verify the OCSS Trust List.
You rarely call it directly. In practice you consume it through one of the higher-level Phosra packages, which wire it to the census for you: See the OCSS protocol SDK page for the low-level signReceipt / verifyReceipt / seal / open reference.

Base URLs

PhosraClient defaults to the production URL. Pass baseUrl to point at the sandbox (the one canonical sandbox host) or your local server. The sandbox is open and seeded — no API key required — so you can run any snippet on this page against it immediately.

Roadmap: the unified wrapper

A single @phosra/sdk-dev package that re-exports the management client at its root and the OCSS protocol library under a /protocol subpath — so one install and one import path covered both halves — is a planned convenience layer. It is not published, and there is no @phosra/sdk-dev on npm today (a request for it returns 404). The final package name and shape are a publish-time decision. Until then, compose the published packages above. There is no functionality gap — the unified wrapper would only save an install line and a subpath, not add any capability.

Further reading