Account Management, Log Streams & more

This update gives your Phase account a home of its own, with two-factor authentication, multiple sign-in methods, and self-service email changes. It also brings Log Streams for shipping audit logs to Datadog, a mobile-friendly Console, a secrets Filter menu with GitHub-style search qualifiers, an AI deployment skill for Azure AKS, published egress IPs for Phase Cloud, and a round of CLI fixes.

Account Management & Two-Factor Authentication

Your Phase account now has a home. The new Account page brings together your profile, email address, sign-in methods, and two-factor authentication in one place. Open it from the user menu in the top right corner of the Console.

• Multiple sign-in methods. Link Google, GitHub, GitLab, Microsoft Entra ID, Okta, or your organisation's SSO provider to one account, alongside a password. Sign in with any of them.
• Two-factor authentication. Protect Console sign-in with a TOTP code from any authenticator app. 2FA applies to every sign-in method on your account, including SSO.
• Profile updates. Update your display name and your account email address.
• Account deletion. Permanently delete your account and all associated data.

Sensitive changes are protected by re-authentication. If your last sign-in is older than 15 minutes, Phase asks you to confirm it's you before the change starts, then returns you to exactly where you left off.

Read the Account management and 2FA docs for details.

Stream Audit Logs & Secret Events to Datadog

Phase can now stream your organisation's audit logs and secret events to Datadog in real-time. Create a stream under Integrations → Log Streams, and Phase pushes structured events to your Datadog account as they happen. No agents, no polling, no inbound access.

• Metadata only. Events describe who did what, where, and when. Secret values, keys, and comments are end-to-end encrypted and never leave Phase.
• Structured for querying. Events ship as JSON aligned with OpenTelemetry semantic conventions, with Datadog standard attributes mapped at delivery time. Filter by actor, app, environment, event type, or source IP.
• Reliable delivery. Delivery is at-least-once, in ordered chunks with automatic retries. A transient failure never silently loses an event. Deduplicate on the stable event.id.
• Fully observable. Each stream shows its delivery status, a per-source delivery delay, and a complete per-delivery history with manual re-ship for anything that failed.
• Auditable. Changes to streams are themselves recorded in the organisation audit log, and export through the stream like any other event.

Read the Log Streams docs for the event schema and delivery guarantees.

Secrets Filtering & Search Qualifiers

When an environment holds hundreds of secrets, sort and plain-text search only get you so far. The secrets editor now has a Filter menu and search qualifiers, in both the single-environment editor and the cross-environment overview.

The Filter menu lets you narrow the list by:

• Type: secret, sealed, or config
• Management: rotating secrets, dynamic secrets, or secrets with an active personal override
• Tags: any tag present in the current view

If you'd rather stay on the keyboard, the same filters work as GitHub-style qualifiers in the search box: redis type:config, is:rotating, or tag:"db creds", freely combined with plain-text search. Unknown qualifiers are treated as regular text, so a typo never empties the list.

Filters compose the way you'd expect. Values within one category broaden the match (Config + Sealed = either). Different categories narrow it (Config + Rotating = both). Consistent with Phase's end-to-end encryption model, all filtering and search runs entirely client-side. The server never sees your query.

A Mobile-Friendly Console

We have improved Console scaling and responsiveness to work better on mobile screens, across navigation, apps, access control, logs, settings, and onboarding:

• Bottom navigation with an overflow menu for quick access to every section
• Simplified headers and breadcrumbs on small screens
• Better scrolling for tables and the secrets editors
• Dialog and page overflow fixes, so content fits narrow viewports

Deploy Phase on Azure AKS with an AI Skill

Deploying anything on Kubernetes involves a long tail of environment-specific decisions and failure modes. We released an AI skill that deploys Phase on Azure Kubernetes Service for you. Think of it as a forward-deployed engineer you can hand to your infra team.

Install it into your AI coding agent (Claude Code, Cursor, Windsurf, or GitHub Copilot) via the skills ecosystem:

npx skills add phasehq/ai -s aks

Then ask your agent to "deploy Phase on AKS". The skill interviews you about the deployment: custom domains, Tailscale ingress and egress, an in-cluster or external managed database, backups, region and resource groups, and connectivity to private services like a LiteLLM gateway. It then plans and executes the rollout. Sensitive steps stay in your hands: the agent stops and asks you to generate credentials and passwords yourself rather than handling them on your behalf.

When something goes wrong mid-deploy, as it often does with Kubernetes, the skill works through the relevant documentation and troubleshooting guides to fix the issue on its own. It stays useful beyond day one: keep it installed to help harden and maintain the deployment over time.

The full collection also includes skills for Docker Compose, generic Kubernetes, and AWS EKS deployments. Install everything with npx skills add phasehq/ai.

Two step-by-step Helm deployment guides are also live in the docs: Azure AKS and AWS EKS. The AKS guide covers standard networking, private Tailscale-only access, and publishing via Tailscale Funnel.

Phase Cloud Egress IP Ranges

If Phase Cloud syncs secrets to infrastructure behind a firewall (a self-hosted GitLab, an internal Vault, a private gateway), you can now allowlist the static IP addresses that Phase Cloud egress traffic originates from.

The list is published as a machine-readable source of truth, updated in advance of any change:

curl -s https://docs.phase.dev/cloud/ips.txt

See the Egress IP addresses section of the security docs for details and the JSON variant.

CLI v2.3.1

A patch release with two fixes:

• PHASE_VERIFY_SSL now works. The CLI's SSL error message has long suggested setting PHASE_VERIFY_SSL=False to bypass certificate verification, but the variable wasn't being read. It now works across all commands, including the pre-auth external identity flows (phase auth --mode aws-iam / --mode azure) against self-hosted instances with self-signed certificates. The flag is fail-closed: verification stays on unless the value is exactly false. It is intended for development and break-glass use. For production, trust your CA instead.
• Installer fix for binary installs. On systems that install via the standalone binary path (e.g. Arch Linux), upgrading from CLI v1 could delete the freshly installed v2 binary while cleaning up v1 leftovers, leaving no phase command at all. The installer now preserves the new binary while removing the legacy files.

Thanks to first-time contributor @sundaram2021 for the SSL fix.

Security

Two security fixes shipped this cycle. If you self-host, upgrade to the latest Console release.

• GitHub integration hardening. The GitHub integration's OAuth connection flow is now bound to the session that started it, with stricter callback validation. Tracked as GHSA-68r4-53vq-4fqm and fixed in Console v2.73.2.
• Legacy service tokens scoped correctly. Legacy service tokens can now only access the environments they were provisioned for.

To be clear on scope, the GitHub fix does not affect you if you use GitHub to log in to Phase (OAuth SSO). It only affects instances that have a GitHub OAuth integration configured. If that's you, we strongly advise upgrading.

As a precautionary measure, if you had a GitHub or GitHub Enterprise integration set up and your instance is publicly exposed, please also rotate your GitHub OAuth integration key. More details are in the security advisory.

Phase Cloud users: you're good. No action needed on your end.

Other improvements and fixes

• Sync status for custom roles. Viewing syncs no longer fails for members whose role lacks access to integration credentials.
• Faster log purging. Retention-based audit log cleanup is faster and lighter on the database for large self-hosted instances.
• Service Account access for Managers. Members with the default Manager role are now correctly provisioned with Service Account handler keys, so they can generate tokens and manage key storage settings as their role's permissions indicate.
• Instant secret type updates in the cross-environment editor. Changing a secret's type updates value visibility immediately, and sealed secrets show their locked state right after deploying, with no page refresh needed.
• Secret row menu polish. The hover menus on secret rows now align flush with their fields, blend correctly when a field is focused, and size consistently across screen sizes. Long comments no longer overflow the key column.

All features are live on Phase Cloud and available in the latest releases for self-hosted users.

As always, we'd love your feedback. Come say hi on Slack, X, or GitHub.