New features andimprovements to Phase

We've added support for automated secret rotation, along with several other platform updates and improvements. We also rewrote the Kubernetes Secrets Operator in Go (2.0), overhauled the secret deployment pipeline so references stay in sync across apps, added self-hosting on Tailscale, and shipped rotation support across the CLI, SDK, and REST API.

A wave of access control and platform upgrades — Teams with team-owned service accounts and role overrides, SCIM v2 provisioning to drive the user lifecycle from your identity provider, the full management REST API for Apps, Environments, Roles, Service Accounts, and Members, and a new org-wide audit log that captures every management action across your organization. Here's the full recap.

April brought Azure authentication and offline mode to the CLI and Go SDK, inline autocomplete and validation for secret references in the Console, email + password sign-in, and self-serve organization SSO. Here's the full recap.

March was a major release month. We rewrote the CLI from Python to Go — shipping a single binary across 16 platform targets that's 75-90% smaller. We introduced Secret Types with sealed write-only secrets, added Azure as a second external identity provider, launched Azure Key Vault sync, released Go SDK 2.0 with pure-Go cryptography, and shipped native AI agent integration. Here's everything.

February brought organization ownership transfer, the official Phase Console Helm Chart 1.0 for Kubernetes self-hosting, SOC 2 Type II certification, and a series of UI/UX improvements and bug fixes. Here's the full recap.

January brought API rate limiting to the REST API, GitHub Dependabot secret sync, a major architectural improvement to the Kubernetes Operator, and a wave of security hardening. Here's the full recap.

December was a stability and reliability month. We resolved a series of secret referencing edge cases across both Console and CLI, shipped a significant backend performance optimization, improved Docker images for self-hosted deployments, and fixed several bugs. Here's the recap.

November was a security-focused month at Phase. We completed our external penetration test with Oneleet and remediated all findings, achieved SOC 2 Type II compliance, shipped Okta OIDC SSO, and hardened the platform across the board. Here's a full recap.

A packed month for the Phase platform — we shipped External Identities with AWS IAM auth, brought Dynamic Secrets to the CLI, added GitHub Environments and Vercel custom environment sync support, improved macOS packaging, and much more. Here's a recap.

We're excited to introduce Dynamic Secrets, a major leap in reducing the attack surface of your secrets. With this update, you can now generate short-lived, one-off credentials on demand that automatically expire once they have been used by the target machine, workflow or environment. This means fewer long-lived static secrets, far smaller blast radius in case of exposure, and stronger auditability across your organization. We're rolling out Dynamic Secrets for Enterprise tier users with support for AWS IAM, with many more providers on the roadmap!

July was another busy month, with the platform seeing native integration for Render, support for Authentik SSO, new features, optimizations and bug fixes. Here's a quick catch-up of everything we've shipped over the last few weeks.

Phase now natively integrates with AWS using Assume Role authentication. We've also shipped a complete revamp of access management, and a new search feature for secrets via the command palette. This is one of our biggest releases to date, and we're excited to share it with you.

The Phase platform has seen significant feature updates and improvements this April, including support for cross-app secret referencing, network access policies, enhanced log filtering and more. Here's a recap of all the recent changes.

We've added native integration for Cloudflare Workers along with a host of new features and DX updates including:

• OIDC Auth for self-hosted instances supporting Google, Microsoft Entra ID and JumpCloud
• Drag & drop imports in the Console to seamlessly import .env files into apps and environments
• A one-click programmatic access menu to get a one-liner shell command to fetch secrets based on your app, environment and folder
• Improved folder UX when managing secrets across environments
• Editable app names
• UI optimizations for smaller screens

We've improved the way database migrations are handled in the Console, giving self-hosted users more control over how and when migrations are run. We've also added a utility to manage audit log retention.

We're happy to announce the release of our Node.js SDK with full secrets management support including end-to-end encryption, secret referencing, personal override support and more! We've also updated the Console with a suite of UX and DX improvements to make common workflows around things like Integrations, Service Accounts and the CLI require fewer clicks and be more seamless.

The Console has been updated with new features and UX improvements to make managing secrets across environments easier and more intuitive. We've also shipped several performance optimizations, bugfixes, and improved secret handling for self-hosted users.

Service accounts provide a new and improved way to access secrets programmatically, functioning like the machine equivalent of human user accounts. Service accounts improve upon service tokens by enabling access across multiple apps and environments, and integrating natively with the new access control and permissions engine.

The Phase Console now natively integrates with Vercel, allowing you to sync secrets and environment variables to your Vercel projects. You can sync secrets to specific environments (Production, Preview, Development) or all environments at once.

Access control across the Phase platform has been reworked from the ground up to be more granular and completely customizable. We've added a whole new modular permissions framework, with 3 managed roles and full support for custom roles.

We're excited to announce the release of the official Phase Terraform Provider. This integration allows you to securely retrieve secrets stored in Phase directly within your Terraform configurations, enabling seamless incorporation of secret management into your infrastructure-as-code workflows.

We've shipped several UX updates this month to streamline workflows around the Console and reduce developer fritch including a new command palette, updated UX for editing secrets and a more detailed apps overview screen.

We're excited to announce the release of native Golang and Python SDKs for Phase. These SDKs allow you to programmatically manage your application secrets with end-to-end encryption straight from your code.

Custom Environment support is now live! You can create, delete, rename and reorder environments to match your team's preferred workflow and tailor your own secret management setup.

You can now sync secrets and environment variables to your Projects and Services on Railway. We've also added support for managing personal overrides from the Phase CLI, along with bug fixes and optimizations for self-hosted users.

The Phase Console now natively integrates with GitLab CI, allowing you to sync secrets and variables to your GitLab CI pipelines and jobs. You can sync secrets to both groups and projects. We've also added the ability to use self-hosted GitLab instances to authenticate with the Phase Console.

The Phase Console now natively integrates with Hashicorp Nomad, allowing you to sync secrets to Nomad variables and use them with your Nomad Jobs. We've also shipped several quality of life improvements, new features and bugfixes to the Console and API.

You can now manage your application secrets programmatically via a public REST API. The API is availalable on all pricing tiers for both Phase Cloud and Phase Self-hosted users, and allows you to create, fetch, update and delete secrets.

The Console now automatically detects boolean values and adds a toggle switch to easily flip between true and false states.

You can now securely share secrets with users outside of your team with Phase Console's Secret Sharing feature: Lockbox. Secrets shared with Lockbox are encrypted with zero-trust encryption, and can only be accessed and views using the link. You can set a custom expiry policy for the link based on either number of views or a fixed expiry time.

We've revamped the UX for unlocking the user keyring with your sudo password to be significantly less disruptive to your workflow. We've also added the option to skip entering your password entirely on trusted browsers and devices.

Secrets can now be managed within folders, and will keep track of the path that they are stored under. This makes it much easier to use Phase for monorepo projects or multi-tennant use-cases. All existing secrets are given the root / path by default.

The Phase Console now has native integration with Hashicorp Vault, allowing you to keep your existing Vault setup in-place while using Phase for development or staging environments. The integration works for self-hosted instances of Vault as well as Hashicorp Cloud Platform.

The Phase Console now has native integration with GitHub Actions, allowing you to use Phase to inject secrets into your Workflows. Phase will make sure your CI runs, build pipelines and test environments use up-to-date secrets without any manual intervention required.

The Phase Console now has native integration with AWS Secrets Manager, allowing you to use Phase as a single source of truth for all secrets in your AWS Stack.

Third party integrations are now live in the Phase Console. This allows native integrations with a host of third party providers to keep your secrets automatically in-sync.

You can now override the value of Secret with a Personal Secret. This lets you supply a one-off value for a given secret that is specific to your local development environment, without having to modify the secret for the rest of your team.

Running phase auth in the CLI now opens up a new tab in your default web browser and redirects you to the Phase Console for authentication. This is a seamless process that allows users to authenticate with their existing accounts without needing to manually generate, copy and paste personal access tokens.