--- title: "GCP Secret Manager, Supabase Edge Functions & more | Phase Changelog" description: "Syncs for Google Cloud Secret Manager and Supabase Edge Functions, role grant limits, the retirement of legacy service tokens, 11 security fixes, and more." url: https://phase.dev/changelog/gcp-secret-manager-supabase-sync/ --- [Changelog](https://phase.dev/changelog/) 2026.09.30 # GCP Secret Manager, Supabase Edge Functions & more Syncs for Google Cloud Secret Manager and Supabase Edge Functions, role grant limits, the retirement of legacy service tokens, 11 security fixes, and more. [integrations](https://phase.dev/changelog/tag/integrations/)[security](https://phase.dev/changelog/tag/security/)[access-control](https://phase.dev/changelog/tag/access-control/)[console](https://phase.dev/changelog/tag/console/)[gcp](https://phase.dev/changelog/tag/gcp/)[supabase](https://phase.dev/changelog/tag/supabase/)[cli](https://phase.dev/changelog/tag/cli/)[kubernetes](https://phase.dev/changelog/tag/kubernetes/)[sdk](https://phase.dev/changelog/tag/sdk/)[self-hosting](https://phase.dev/changelog/tag/self-hosting/) We've added two new sync integrations: Google Cloud Secret Manager and Supabase Edge Functions. Other updates include role grant limits, 11 security fixes, and patch releases of the Kubernetes Operator and Go SDK. **Legacy service tokens have been retired.** They no longer work on Phase Cloud, or on self-hosted instances running Console v2.77.0 or later. If you still use one, [switch to a service account token](#legacy-service-tokens-retired). * * * ## GCP Secret Manager Sync Phase can now sync secrets to **Google Cloud Secret Manager**, joining the existing AWS Secrets Manager and Azure Key Vault syncs. ![Creating a GCP Secret Manager sync, with one secret per key and a name prefix](https://phase.dev/assets/images/changelog/gcp-secret-manager-supabase-sync/gcp-sync-one-secret-per-key.webp) Phase connects to Google Cloud with Workload Identity Federation, so there are no service account keys to create, store, or rotate. Enter your Google Cloud project number, and Phase generates a `gcloud` script to run in Cloud Shell. The script sets up a Workload Identity provider that trusts only your Phase credential, and grants the Secret Manager roles Phase needs. Here's the core of it: ```bash # Abridged. The full script Phase generates sets these variables # and writes this credential's public key to phase-jwks.json. gcloud services enable iam.googleapis.com sts.googleapis.com \ cloudresourcemanager.googleapis.com secretmanager.googleapis.com \ --project="$PROJECT_NUMBER" gcloud iam workload-identity-pools create phase --location=global \ --project="$PROJECT_ID" --display-name="Phase" gcloud iam workload-identity-pools providers create-oidc "$PROVIDER_ID" \ --location=global --workload-identity-pool=phase --project="$PROJECT_ID" \ --display-name="Phase" --issuer-uri="$ISSUER" --jwk-json-path=phase-jwks.json \ --attribute-mapping="google.subject=assertion.sub" \ --attribute-condition="assertion.sub == \"$SUBJECT\"" for ROLE in roles/secretmanager.editor roles/secretmanager.secretAccessor; do gcloud projects add-iam-policy-binding "$PROJECT_ID" --role="$ROLE" \ --member="$PRINCIPAL" --condition=None done ``` ![Enter your project number, and Phase generates the setup script](https://phase.dev/assets/images/changelog/gcp-secret-manager-supabase-sync/gcp-credential-setup.webp) Choose how your secrets land in Secret Manager: - **One secret per key**, with an optional name prefix so several environments can share a project. - **Single JSON secret**, with every key in one JSON object. ![Creating a GCP Secret Manager sync with a single JSON secret](https://phase.dev/assets/images/changelog/gcp-secret-manager-supabase-sync/gcp-sync-single-json.webp) You can also choose where secrets are stored for data residency, and encrypt them with your own Cloud KMS key. When you create a sync, you confirm that Phase will take over secrets with the same names. Phase never deletes secrets from your project, but it destroys versions older than the previous one. With one secret per key, it disables a secret when its key leaves Phase or its value is empty. ![An active GCP Secret Manager sync, with its project and name prefix](https://phase.dev/assets/images/changelog/gcp-secret-manager-supabase-sync/gcp-sync-card.webp) Read the [GCP Secret Manager docs](https://docs.phase.dev/integrations/platforms/gcp-secret-manager) to get started. Available in [Console v2.77.0](https://github.com/phasehq/console/releases/tag/v2.77.0). * * * ## Supabase Edge Functions Sync Phase can now sync secrets to a Supabase project's **Edge Function secrets**. Your functions read them as environment variables, with no redeploy. The integration started as a [feature request from @bnjns](https://github.com/phasehq/console/issues/1013) on GitHub and was released four days later. ![Supabase and Google Cloud join the list of third-party credential providers](https://phase.dev/assets/images/changelog/gcp-secret-manager-supabase-sync/credential-providers.webp) Connect with a Supabase personal access token, then pick a Phase environment and a Supabase project. Phase syncs when you create the sync, and again whenever your secrets change. ![Creating a Supabase Edge Functions sync](https://phase.dev/assets/images/changelog/gcp-secret-manager-supabase-sync/supabase-sync.webp) ![An active Supabase Edge Functions sync](https://phase.dev/assets/images/changelog/gcp-secret-manager-supabase-sync/supabase-sync-card.webp) Phase is the source of truth for the project. It overwrites secrets with the same names and removes any others, apart from the `SUPABASE_` secrets that Supabase manages itself. Import your existing Edge Function secrets into Phase before you connect a project. Read the [Supabase docs](https://docs.phase.dev/integrations/platforms/supabase) to get started. Available in [Console v2.76.0](https://github.com/phasehq/console/releases/tag/v2.76.0). * * * ## Legacy Service Tokens Retired [Console v2.77.0](https://github.com/phasehq/console/releases/tag/v2.77.0) retires legacy service tokens. These were the per-app tokens created from an app's **Access → Service Tokens** tab, which Service Accounts replaced in November 2024. Requests made with a legacy token are now rejected. This took effect on Phase Cloud on 24 September, and applies to self-hosted instances when they upgrade. Service account tokens are unaffected. To tell them apart, legacy service tokens start with `pss_service:v1:` and service account tokens start with `pss_service:v2:`. **What to do.** Create a [Service Account](https://docs.phase.dev/access-control/service-accounts), give it access to the apps and environments it needs, and use its token wherever you used the old one. Environment variables like `PHASE_SERVICE_TOKEN` keep the same name. For direct REST API calls, use the service account's **API token**, not the `pss_service:v2:` token. The header changes from `Bearer Service ` to `Bearer ServiceAccount `. The app-level **Tokens** permission, which controlled legacy service tokens, has also been removed from roles. * * * ## Role Grant Limits You can now only grant permissions that your own role holds, in both the Console and the API. Owners and Admins can still delegate freely. The Console shows what's out of reach before you try. Permissions your role doesn't include are disabled in the role editor, and roles that exceed your permissions are locked in role pickers. ![The role editor disables permissions that your own role doesn't include](https://phase.dev/assets/images/changelog/gcp-secret-manager-supabase-sync/role-grant-limits.png) The default Manager role can now also delete environments. Read the [Roles docs](https://docs.phase.dev/access-control/roles#custom-roles) for details. Available in [Console v2.77.0](https://github.com/phasehq/console/releases/tag/v2.77.0). * * * ## Clearer Empty Results in the CLI When `phase run` or `phase shell` finds no secrets, the CLI now names the app and environment it queried and suggests how to widen the search. Previously it printed blank labels that looked like an authentication failure. The most common case is secrets that live in folders, which the default path of `/` doesn't include: ```bash # Before 🚀 Injected 0 secrets from Application: , Environment: # After 🚀 Injected 0 secrets from Application: example-app, Environment: Development 💡 No secrets found at path /. Secrets under other paths are not included — pass --path "" to inject secrets from all paths. ``` `phase secrets list`, `secrets export`, and `secrets get` also explain empty results now. Available in [CLI v2.3.2](https://github.com/phasehq/cli/releases/tag/v2.3.2). See the [install docs](https://docs.phase.dev/cli/install#updates) to update. * * * ## Security We fixed 11 security issues, all reported privately through GitHub, and added further hardening across the Console. **If you self-host, upgrade to [Console v2.77.0](https://github.com/phasehq/console/releases/tag/v2.77.0) or later.** - **Secret access scoped to environments.** Secret updates and deletes from the CLI and SDKs now only reach the environment a token is authenticated for. Tracked as [GHSA-vm8v-jfg8-395p](https://github.com/phasehq/console/security/advisories/GHSA-vm8v-jfg8-395p) and [GHSA-r738-p95h-7v77](https://github.com/phasehq/console/security/advisories/GHSA-r738-p95h-7v77). - **Roles.** Built-in roles can no longer be modified, custom roles can no longer be given global access, and role grants are bounded by your own permissions. Tracked as [GHSA-p2hv-8f6c-vq8p](https://github.com/phasehq/console/security/advisories/GHSA-p2hv-8f6c-vq8p) and [GHSA-52hc-5ggc-2pr6](https://github.com/phasehq/console/security/advisories/GHSA-52hc-5ggc-2pr6). - **Integrations and syncs.** Creating and managing syncs now requires the matching Integrations permissions, and a sync can only use stored credentials from its own organisation. Tracked as [GHSA-7p66-9m7f-qwgj](https://github.com/phasehq/console/security/advisories/GHSA-7p66-9m7f-qwgj), [GHSA-2x9x-9cw7-3hjf](https://github.com/phasehq/console/security/advisories/GHSA-2x9x-9cw7-3hjf), and [GHSA-gqmf-vrw2-rjp4](https://github.com/phasehq/console/security/advisories/GHSA-gqmf-vrw2-rjp4). - **App membership and environment access.** Adding members and service accounts to apps, and granting them environment access, are now validated against the app's organisation and your permissions. Tracked as [GHSA-3c6f-7hxx-hfxc](https://github.com/phasehq/console/security/advisories/GHSA-3c6f-7hxx-hfxc), [GHSA-jhc8-3m3p-ffwf](https://github.com/phasehq/console/security/advisories/GHSA-jhc8-3m3p-ffwf), and [GHSA-f4qc-f4mp-x579](https://github.com/phasehq/console/security/advisories/GHSA-f4qc-f4mp-x579). - **Billing details.** The post-checkout billing summary on Phase Cloud now requires Billing access. Tracked as [GHSA-mp3h-r64x-3rq5](https://github.com/phasehq/console/security/advisories/GHSA-mp3h-r64x-3rq5). - **CSRF protection.** The Console now requires a CSRF token and a trusted origin on its session-based endpoints. The CLI, SDKs, REST API, and integrations are unaffected. - **Token key exchange.** The endpoint the CLI and SDKs call to fetch a token's key material now applies the same token checks, network access policies, and rate limits as the rest of the API. - **Service account tokens.** Queries for a service account's tokens now return metadata only, and issuing its first token requires permission to create tokens. - **Pinned CI actions.** Every GitHub Action in the Console's CI workflows is now pinned to a full commit SHA. **Phase Cloud users: you're good.** The fixes are already live. If you use custom roles to manage syncs, make sure they include the Integrations and Integration Credentials permissions. * * * ## Other improvements and fixes - **Token and share link expiry in UTC.** Expiry times for tokens and Lockbox links are now stored in UTC, so they're correct on servers with a non-UTC timezone. Thanks to first-time contributor [@omlahore](https://github.com/omlahore) for the fix. - **Sync setup dialogs.** Changing an earlier choice in the GitHub Actions, Vercel, Railway, and Render sync dialogs now resets the choices that depend on it, so a sync always targets what's on screen. - **Cross-app references in the CLI.** A reference nested inside a cross-app reference's value now resolves against the referenced app, not the app you're fetching from. Available in [CLI v2.3.2](https://github.com/phasehq/cli/releases/tag/v2.3.2). - **[Kubernetes Operator v2.0.1](https://github.com/phasehq/kubernetes-secrets-operator/releases/tag/v2.0.1) and [Go SDK v2.4.1](https://github.com/phasehq/golang-sdk/releases/tag/v2.4.1).** Both update Go dependencies to pick up upstream security fixes. The Go SDK now requires Go 1.25 or later. - **Next.js 16.** The Console frontend now runs on Next.js 16 and React 19, and production builds use Turbopack. - **Dependency updates.** Routine security updates across the Console's dependencies. * * * All features are live on [Phase Cloud](https://console.phase.dev) and available in the latest releases for self-hosted users. As always, we'd love your feedback. Come say hi on [Slack](https://slack.phase.dev), [X](https://x.com/phasedotdev), or [GitHub](https://github.com/phasehq). RoadmapCommunity-driven Request a feature We build features based on community requests and feedback. Looking for a specific feature or have a use-case in mind? Reach out to us. [Feature request](https://github.com/phasehq/console/issues/new?template=feature_request.md) DeploymentSelf-hosted / Cloud Get started ## Keep your secrets Self-host or start on fully managed Cloud in under a minute. Self-hosted Run Phase on your own infrastructure. Free and open source. AI agent deployment skill [![Docker Compose logo](https://phase.dev/assets/images/docker.svg)](https://docs.phase.dev/self-hosting/docker-compose)[![Kubernetes logo](https://phase.dev/assets/images/kubernetes.svg)](https://docs.phase.dev/self-hosting/kubernetes)[![AWS logo](https://phase.dev/assets/images/aws.svg)](https://docs.phase.dev/self-hosting/aws-eks)[![GCP logo](https://phase.dev/assets/images/gcp.svg)](https://docs.phase.dev/self-hosting/gcp)[![Azure logo](https://phase.dev/assets/images/azure.svg)](https://docs.phase.dev/self-hosting/azure)[![Railway logo](https://phase.dev/assets/images/railway.svg)](https://docs.phase.dev/self-hosting/railway)[![Raspberry Pi logo](https://phase.dev/assets/images/raspberry.svg)](https://docs.phase.dev/self-hosting/raspberrypi) [Self-hosting guide](https://docs.phase.dev/self-hosting) Cloud Fully managed. From signup to your first secret in 60 seconds. Sign up with [Google](https://console.phase.dev/login?provider=google)[GitHub](https://console.phase.dev/login?provider=github)[GitLab](https://console.phase.dev/login?provider=gitlab)