Running phase auth in the CLI now opens up a new tab in your default web browser and redirects you to the Phase Console for authentication.
This is a seamless process that allows users to authenticate with their existing accounts without needing to manually generate, copy and paste personal access tokens.
Previously, authentication for the CLI was done by generating a PAT in the console, copying it, then pasting it into the terminal when prompted. This process was cumbersome and prone to errors.
Now, running phase auth will open a new tab in your default web browser where you can authenticate with your Phase account by entering the sudo password for the account you want to use the CLI with.
The link to the Phase Console at /webauth contains an ephemeral public key to encrypt credentials for secure transport to the CLI, and a host (localhost) + random port to send the encrypted credentials to.
The Console generates a PAT for you tagged with your system username, encryptes them with the public key and transmits them via a POST request to the CLI.
The CLI decrypts your PAT and stores it in your system keyring for future use.
After successful authentication, the CLI remembers this session for future use, so you won't need to re-authenticate every time.
Self hosted
Users self-hosting Phase can also use this feature by selecting "Self Hosted" when running phasse auth
Enter the hostname for your Phase Console instance, and the CLI will open a new tab in your default web browser to authenticate with it.
Webauth is available in Phase Console v2.1.0 and Phase CLI v1.8.0