#cli

We've added support for automated secret rotation, along with several other platform updates and improvements. We also rewrote the Kubernetes Secrets Operator in Go (2.0), overhauled the secret deployment pipeline so references stay in sync across apps, added self-hosting on Tailscale, and shipped rotation support across the CLI, SDK, and REST API.

April brought Azure authentication and offline mode to the CLI and Go SDK, inline autocomplete and validation for secret references in the Console, email + password sign-in, and self-serve organization SSO. Here's the full recap.

March was a major release month. We rewrote the CLI from Python to Go — shipping a single binary across 16 platform targets that's 75-90% smaller. We introduced Secret Types with sealed write-only secrets, added Azure as a second external identity provider, launched Azure Key Vault sync, released Go SDK 2.0 with pure-Go cryptography, and shipped native AI agent integration. Here's everything.

February brought organization ownership transfer, the official Phase Console Helm Chart 1.0 for Kubernetes self-hosting, SOC 2 Type II certification, and a series of UI/UX improvements and bug fixes. Here's the full recap.

January brought API rate limiting to the REST API, GitHub Dependabot secret sync, a major architectural improvement to the Kubernetes Operator, and a wave of security hardening. Here's the full recap.

December was a stability and reliability month. We resolved a series of secret referencing edge cases across both Console and CLI, shipped a significant backend performance optimization, improved Docker images for self-hosted deployments, and fixed several bugs. Here's the recap.

A packed month for the Phase platform — we shipped External Identities with AWS IAM auth, brought Dynamic Secrets to the CLI, added GitHub Environments and Vercel custom environment sync support, improved macOS packaging, and much more. Here's a recap.

We're excited to introduce Dynamic Secrets, a major leap in reducing the attack surface of your secrets. With this update, you can now generate short-lived, one-off credentials on demand that automatically expire once they have been used by the target machine, workflow or environment. This means fewer long-lived static secrets, far smaller blast radius in case of exposure, and stronger auditability across your organization. We're rolling out Dynamic Secrets for Enterprise tier users with support for AWS IAM, with many more providers on the roadmap!

The Phase platform has seen significant feature updates and improvements this April, including support for cross-app secret referencing, network access policies, enhanced log filtering and more. Here's a recap of all the recent changes.

The Console has been updated with new features and UX improvements to make managing secrets across environments easier and more intuitive. We've also shipped several performance optimizations, bugfixes, and improved secret handling for self-hosted users.

Access control across the Phase platform has been reworked from the ground up to be more granular and completely customizable. We've added a whole new modular permissions framework, with 3 managed roles and full support for custom roles.

Custom Environment support is now live! You can create, delete, rename and reorder environments to match your team's preferred workflow and tailor your own secret management setup.

You can now sync secrets and environment variables to your Projects and Services on Railway. We've also added support for managing personal overrides from the Phase CLI, along with bug fixes and optimizations for self-hosted users.

Secrets can now be managed within folders, and will keep track of the path that they are stored under. This makes it much easier to use Phase for monorepo projects or multi-tennant use-cases. All existing secrets are given the root / path by default.

You can now override the value of Secret with a Personal Secret. This lets you supply a one-off value for a given secret that is specific to your local development environment, without having to modify the secret for the rest of your team.

Running phase auth in the CLI now opens up a new tab in your default web browser and redirects you to the Phase Console for authentication. This is a seamless process that allows users to authenticate with their existing accounts without needing to manually generate, copy and paste personal access tokens.