Skip to main content
The @phosra/sdk package provides a typed client for the Phosra API, with support for Node.js and browser environments.
Verified against the published package. Everything on this page was checked against @phosra/sdk@0.1.0 (the current npm release) and the code was run against the live sandbox — see Verified live at the bottom.

Installation

Latest published version: 0.1.0. Pin the exact version in package.json — do not float on a caret range while the package is pre-1.0, since a 0.x minor may break (see SDK versioning):

Quick Start

Every tab below leads with the open sandboxhttps://phosra-api-sandbox-production.up.railway.app — so your first copy-paste returns 201 with no API key. Paste any tab as-is and run it; nothing you create in the sandbox touches production. The Get a production key step (a real dashboard link) comes after you’ve seen it work.
Ran the TypeScript tab above verbatim against the sandbox and it printed Emma's Family preteen 20 — see Verified live for the exact command and output.

Going to production

The sandbox is open. Production requires a phosra_ API key — pass it as apiKey (the SDK sends it as X-Api-Key) and drop the sandbox baseUrl so the client uses the default production host:

Get your API key

Sign up at dashboard.phosra.com/signup, then mint a key on the Keys page — phosra_test_… for the sandbox, phosra_live_… for production. See Authentication for the full key lifecycle.

Authentication

PhosraClientConfig accepts exactly these fields (verified against @phosra/sdk@0.1.0):
The SDK sends apiKey as the X-Api-Key header internally; the raw curl / Python / Go tabs above send the same key as Authorization: Bearer (the canonical header the rest of the docs use). The API accepts both interchangeably — pick either. See Authentication.
Precedence when more than one credential is set: deviceKey > apiKey > accessToken.

Refreshing an expired token

There is no maxRetries/retryDelay option in @phosra/sdk@0.1.0. Token refresh is handled by the onTokenExpired callback — the client calls it on a 401, then retries the request once with the returned token:

Resource Namespaces

The client organizes endpoints into resource namespaces:
The auth namespace ships register/login/refresh methods, but those three routes do not exist on the Go APIPOST /auth/register, /auth/login, and /auth/refresh all return 404 (identity lives in WorkOS AuthKit; see Authentication). Only auth.me() and auth.logout() are backed by live endpoints (logout is a documented no-op). Treat the other three as dead surface in @phosra/sdk@0.1.0.

Error Handling

The SDK throws typed errors. PhosraError is the base class (it carries only message); API failures throw a PhosraApiError (or one of its subclasses) which adds statusCode, code, and details. For the full wire-level status/class matrix (every 4xx/5xx, its cause, and its fix) see the Errors reference:
The full exported error hierarchy (all extend PhosraError):

Full Example: Setup to Enforcement

Resource methods (verified surface)

Every namespace and method below exists on PhosraClient in @phosra/sdk@0.1.0:

Verified live

The Quick Start code was run against the open sandbox census (https://phosra-api-sandbox-production.up.railway.app/api/v1, no key required) with @phosra/sdk@0.1.0:
Actual output:
Point baseUrl at the sandbox to try any snippet on this page without an API key. For production, drop baseUrl (it defaults to https://prodapi.phosra.com/api/v1) and pass a phosra_ key — get one on the dashboard.