Environments

Phosra currently documents one public OCSS evaluation host:

text

https://phosra-api-sandbox-production.up.railway.app

It contains synthetic families, identities, registry entries, tier fields, receipts, OAuth profiles, and platform records. Treat every value as disposable test data.

Environment matrix

Environment	Purpose	Data
Public hosted sandbox	Partner evaluation and SDK/CLI testing	Synthetic fixtures only
Local development	Tests, harnesses, and self-hosted experiments	Developer-controlled
Phosra product/control API	Account and product-management surfaces where access is provisioned	Not an OCSS production federation
Hosted production OCSS routing	Roadmap	No public endpoint or credentials claimed

The prodapi.phosra.com host may appear in product/control-plane documentation. It must not be treated as a public production OCSS census, Trust List, decision router, or receipt rail.

Sandbox URLs

bash

export PHOSRA_SANDBOX_ROOT="https://phosra-api-sandbox-production.up.railway.app"
export PHOSRA_SANDBOX_API="$PHOSRA_SANDBOX_ROOT/api/v1"

The reference OAuth routes are on the host root:

text

/oauth/authorize
/oauth/token
/oauth/profiles

Product and sandbox data-plane routes are generally under /api/v1. Well-known signed test artifacts are served from /.well-known/ocss/*.

Credentials

Open sandbox routes require no product API key.
Signed sandbox routes require a fresh locally generated key and the synthetic identity returned by sandbox self-registration.
A phosra_test_ credential is secret even when limited to test data; never publish it.
Production OCSS credentials are not publicly issued today.

Public keys, key IDs, signatures, digests, and sample DIDs are not secrets. Private seeds, bearer tokens, one-time codes, connect secrets, endpoint labels, webhook secrets, and API keys are.

Moving beyond evaluation

There is no supported three-variable “flip to production.” A real deployment would require separate production credentials, security review, data handling terms, operational ownership, adapter validation, receipt infrastructure, and an independent governance/accreditation path. Those capabilities are not generally available.

Teams with a concrete workflow can apply to become a design partner and define a bounded beta pilot. Participation does not imply certification or production status.