GCP Secret Manager, Supabase Edge Functions & more

We've added two new sync integrations: Google Cloud Secret Manager and Supabase Edge Functions. Other updates include role grant limits, 11 security fixes, and patch releases of the Kubernetes Operator and Go SDK.

Legacy service tokens have been retired. They no longer work on Phase Cloud, or on self-hosted instances running Console v2.77.0 or later. If you still use one, switch to a service account token.

GCP Secret Manager Sync

Phase can now sync secrets to Google Cloud Secret Manager, joining the existing AWS Secrets Manager and Azure Key Vault syncs.

Creating a GCP Secret Manager sync, with one secret per key and a name prefix

Phase connects to Google Cloud with Workload Identity Federation, so there are no service account keys to create, store, or rotate. Enter your Google Cloud project number, and Phase generates a gcloud script to run in Cloud Shell. The script sets up a Workload Identity provider that trusts only your Phase credential, and grants the Secret Manager roles Phase needs. Here's the core of it:

# Abridged. The full script Phase generates sets these variables
# and writes this credential's public key to phase-jwks.json.
gcloud services enable iam.googleapis.com sts.googleapis.com \
  cloudresourcemanager.googleapis.com secretmanager.googleapis.com \
  --project="$PROJECT_NUMBER"

gcloud iam workload-identity-pools create phase --location=global \
  --project="$PROJECT_ID" --display-name="Phase"

gcloud iam workload-identity-pools providers create-oidc "$PROVIDER_ID" \
  --location=global --workload-identity-pool=phase --project="$PROJECT_ID" \
  --display-name="Phase" --issuer-uri="$ISSUER" --jwk-json-path=phase-jwks.json \
  --attribute-mapping="google.subject=assertion.sub" \
  --attribute-condition="assertion.sub == \"$SUBJECT\""

for ROLE in roles/secretmanager.editor roles/secretmanager.secretAccessor; do
  gcloud projects add-iam-policy-binding "$PROJECT_ID" --role="$ROLE" \
    --member="$PRINCIPAL" --condition=None
done

Enter your project number, and Phase generates the setup script

Choose how your secrets land in Secret Manager:

One secret per key, with an optional name prefix so several environments can share a project.
Single JSON secret, with every key in one JSON object.

Creating a GCP Secret Manager sync with a single JSON secret

You can also choose where secrets are stored for data residency, and encrypt them with your own Cloud KMS key. When you create a sync, you confirm that Phase will take over secrets with the same names. Phase never deletes secrets from your project, but it destroys versions older than the previous one. With one secret per key, it disables a secret when its key leaves Phase or its value is empty.

An active GCP Secret Manager sync, with its project and name prefix

Read the GCP Secret Manager docs to get started.

Available in Console v2.77.0.

Supabase Edge Functions Sync

Phase can now sync secrets to a Supabase project's Edge Function secrets. Your functions read them as environment variables, with no redeploy. The integration started as a feature request from @bnjns on GitHub and was released four days later.

Supabase and Google Cloud join the list of third-party credential providers

Connect with a Supabase personal access token, then pick a Phase environment and a Supabase project. Phase syncs when you create the sync, and again whenever your secrets change.

Creating a Supabase Edge Functions sync

An active Supabase Edge Functions sync

Phase is the source of truth for the project. It overwrites secrets with the same names and removes any others, apart from the SUPABASE_ secrets that Supabase manages itself. Import your existing Edge Function secrets into Phase before you connect a project.

Read the Supabase docs to get started.

Available in Console v2.76.0.

Legacy Service Tokens Retired

Console v2.77.0 retires legacy service tokens. These were the per-app tokens created from an app's Access → Service Tokens tab, which Service Accounts replaced in November 2024. Requests made with a legacy token are now rejected. This took effect on Phase Cloud on 24 September, and applies to self-hosted instances when they upgrade.

Service account tokens are unaffected. To tell them apart, legacy service tokens start with pss_service:v1: and service account tokens start with pss_service:v2:.

What to do. Create a Service Account, give it access to the apps and environments it needs, and use its token wherever you used the old one. Environment variables like PHASE_SERVICE_TOKEN keep the same name. For direct REST API calls, use the service account's API token, not the pss_service:v2: token. The header changes from Bearer Service <value> to Bearer ServiceAccount <value>.

The app-level Tokens permission, which controlled legacy service tokens, has also been removed from roles.

Role Grant Limits

You can now only grant permissions that your own role holds, in both the Console and the API. Owners and Admins can still delegate freely.

The Console shows what's out of reach before you try. Permissions your role doesn't include are disabled in the role editor, and roles that exceed your permissions are locked in role pickers.

The role editor disables permissions that your own role doesn't include

The default Manager role can now also delete environments. Read the Roles docs for details.

Available in Console v2.77.0.

Clearer Empty Results in the CLI

When phase run or phase shell finds no secrets, the CLI now names the app and environment it queried and suggests how to widen the search. Previously it printed blank labels that looked like an authentication failure. The most common case is secrets that live in folders, which the default path of / doesn't include:

# Before
🚀 Injected 0 secrets from Application: , Environment:

# After
🚀 Injected 0 secrets from Application: example-app, Environment: Development
💡 No secrets found at path /. Secrets under other paths are not included — pass --path "" to inject secrets from all paths.

phase secrets list, secrets export, and secrets get also explain empty results now.

Available in CLI v2.3.2. See the install docs to update.

Security

We fixed 11 security issues, all reported privately through GitHub, and added further hardening across the Console. If you self-host, upgrade to Console v2.77.0 or later.

Secret access scoped to environments. Secret updates and deletes from the CLI and SDKs now only reach the environment a token is authenticated for. Tracked as GHSA-vm8v-jfg8-395p and GHSA-r738-p95h-7v77.
Roles. Built-in roles can no longer be modified, custom roles can no longer be given global access, and role grants are bounded by your own permissions. Tracked as GHSA-p2hv-8f6c-vq8p and GHSA-52hc-5ggc-2pr6.
Integrations and syncs. Creating and managing syncs now requires the matching Integrations permissions, and a sync can only use stored credentials from its own organisation. Tracked as GHSA-7p66-9m7f-qwgj, GHSA-2x9x-9cw7-3hjf, and GHSA-gqmf-vrw2-rjp4.
App membership and environment access. Adding members and service accounts to apps, and granting them environment access, are now validated against the app's organisation and your permissions. Tracked as GHSA-3c6f-7hxx-hfxc, GHSA-jhc8-3m3p-ffwf, and GHSA-f4qc-f4mp-x579.
Billing details. The post-checkout billing summary on Phase Cloud now requires Billing access. Tracked as GHSA-mp3h-r64x-3rq5.
CSRF protection. The Console now requires a CSRF token and a trusted origin on its session-based endpoints. The CLI, SDKs, REST API, and integrations are unaffected.
Token key exchange. The endpoint the CLI and SDKs call to fetch a token's key material now applies the same token checks, network access policies, and rate limits as the rest of the API.
Service account tokens. Queries for a service account's tokens now return metadata only, and issuing its first token requires permission to create tokens.
Pinned CI actions. Every GitHub Action in the Console's CI workflows is now pinned to a full commit SHA.

Phase Cloud users: you're good. The fixes are already live. If you use custom roles to manage syncs, make sure they include the Integrations and Integration Credentials permissions.

Other improvements and fixes

Token and share link expiry in UTC. Expiry times for tokens and Lockbox links are now stored in UTC, so they're correct on servers with a non-UTC timezone. Thanks to first-time contributor @omlahore for the fix.
Sync setup dialogs. Changing an earlier choice in the GitHub Actions, Vercel, Railway, and Render sync dialogs now resets the choices that depend on it, so a sync always targets what's on screen.
Cross-app references in the CLI. A reference nested inside a cross-app reference's value now resolves against the referenced app, not the app you're fetching from. Available in CLI v2.3.2.
Kubernetes Operator v2.0.1 and Go SDK v2.4.1. Both update Go dependencies to pick up upstream security fixes. The Go SDK now requires Go 1.25 or later.
Next.js 16. The Console frontend now runs on Next.js 16 and React 19, and production builds use Turbopack.
Dependency updates. Routine security updates across the Console's dependencies.

All features are live on Phase Cloud and available in the latest releases for self-hosted users.

As always, we'd love your feedback. Come say hi on Slack, X, or GitHub.