open-phiz-sdk

Server-side TypeScript SDK for Open Phiz open login. Use this package in the mini-app business backend. Do not bundle it into a mini-app, browser application, Flutter package, or native host app.

Install

bun add open-phiz-sdk

Node.js 22.12 or newer is required.

Exchange a login code

import { OpenPlatformClient } from 'open-phiz-sdk';

const openPlatform = new OpenPlatformClient({
  baseUrl: process.env.OPEN_PHIZ_BASE_URL!,
  appId: process.env.OPEN_PHIZ_APP_ID!,
  appSecret: process.env.OPEN_PHIZ_APP_SECRET!,
});

const session = await openPlatform.code2Session(loginCode);
// Persist your own business session. Do not return sessionKey to the mini-app.

Session and phone APIs

const checked = await openPlatform.checkSession({
  openId: session.openId,
  sessionKey: session.sessionKey,
});

const reset = await openPlatform.resetSession({
  openId: session.openId,
  sessionKey: session.sessionKey,
});

const phoneInfo = await openPlatform.getPhoneNumber({ code: phoneAuthorizationCode });

The SDK obtains and caches the app access_token in memory for session and phone operations. Concurrent refreshes share one request. An invalid internally managed token is refreshed once; an explicitly supplied token is never retried automatically.

Error handling

import { OpenPlatformSdkError } from 'open-phiz-sdk';

try {
  await openPlatform.code2Session(loginCode);
} catch (error) {
  if (error instanceof OpenPlatformSdkError) {
    console.error({
      code: error.code,
      status: error.status,
      requestId: error.requestId,
      retryable: error.retryable,
    });
  }
}

Do not log the login code, AppSecret, access token, session key, or phone authorization code. Use the returned Request ID with the Open Platform diagnostics page.

Transport policy

• HTTPS is mandatory outside localhost unless allowInsecureHttp is explicitly enabled for an isolated development network.
• AppSecret is sent only in JSON request bodies, never in query strings.
• The SDK does not persist credentials or tokens to disk.
• Requests time out after 10 seconds by default and accept an AbortSignal.