diff --git a/docs/src/content/docs/reference/sdk.mdx b/docs/src/content/docs/reference/sdk.mdx
index fe99058..4c64ad8 100644
--- a/docs/src/content/docs/reference/sdk.mdx
+++ b/docs/src/content/docs/reference/sdk.mdx
@@ -48,10 +48,25 @@ function getSecure(key: string): Promise<string>;
 
 **Returns:** `Promise<string>` — the decrypted value.
 
-**Throws:** `REPError` if the session key endpoint is unreachable, the key has expired, or decryption fails.
+**Throws:** `REPError` in the following cases:
+- The requested key does not exist in the sensitive payload
+- The session key endpoint is unreachable or returns a non-2xx status
+- The session key has expired (30s TTL)
+- Decryption fails (corrupted payload or mismatched key)
+
+Always wrap `getSecure()` in a try/catch:
 
 ```typescript
-const key = await rep.getSecure('ANALYTICS_KEY');
+import { rep, REPError } from '@rep-protocol/sdk';
+
+try {
+  const analyticsKey = await rep.getSecure('ANALYTICS_KEY');
+} catch (err) {
+  if (err instanceof REPError) {
+    // Key not found, endpoint unreachable, or decryption failed.
+    console.error(err.message);
+  }
+}
 ```
 
 <Aside>
diff --git a/sdk/src/index.ts b/sdk/src/index.ts
index e126d30..c18df37 100644
--- a/sdk/src/index.ts
+++ b/sdk/src/index.ts
@@ -44,7 +44,7 @@ interface SessionKeyResponse {
 type ChangeCallback = (newValue: string, oldValue: string | undefined) => void;
 type AnyChangeCallback = (key: string, newValue: string, oldValue: string | undefined) => void;
 
-class REPError extends Error {
+export class REPError extends Error {
   constructor(message: string) {
     super(`[REP] ${message}`);
     this.name = 'REPError';