--- title: "Phase | Open-source secrets manager for teams and AI agents" description: "Open source platform for teams and AI agents to securely access, manage and deploy application secrets — from development to production." url: https://phase.dev/ --- # Secrets management for teams and AI agents Open source platform to securely access, manage and deploy application secrets, from development to production. Get started — Sign up with [Google](https://console.phase.dev/login?provider=google)[GitHub](https://console.phase.dev/login?provider=github)[GitLab](https://console.phase.dev/login?provider=gitlab) [Or explore self-hosting](https://docs.phase.dev/self-hosting) Product playground Trusted by thousands of teams ![Zeiss](https://phase.dev/assets/images/customers/zeiss.svg) ![Alchemy](https://phase.dev/assets/images/customers/alchemy.svg) ![GSA](https://phase.dev/assets/images/customers/gsa.svg) ![AoPS](https://phase.dev/assets/images/customers/aops.svg) ![StoryLLP](https://phase.dev/assets/images/customers/storyllp.svg) ![Magneto](https://phase.dev/assets/images/customers/magneto.svg) ![NaroIQ](https://phase.dev/assets/images/customers/naroiq.svg) ![Sellhub](https://phase.dev/assets/images/customers/sellhub.png) ![theFactor.e](https://phase.dev/assets/images/customers/thefactore.svg) ![Palo Alto Networks](https://phase.dev/assets/images/customers/palo-alto-networks.png) 01 — Agents ## Agency without exposure Agents use freshly minted dynamic secrets with their own identity. If they run into any access issues, they automatically ping a team member and ask for higher privileges only when needed. Complete visibility throughout: destructive actions like SQL DROP get blocked and audit-logged. 01.1 — Agents get their own identity AI egress proxy ### Guardrails at the network edge Agents use decoy secrets managed by Phase when making outbound requests to third-party services. The Phase AI proxy inspects each request and checks it against your policy — then injects the real secret mid-flight. 02 — Deploy ## Sync without sprawl Centralize, integrate and automate secret deployment pipelines across your infrastructure. 03 — Govern ACCESS & AUDIT ## Control without friction Manage authentication, role-based access control (RBAC) and network access policies from one place. 03.1 — Teams Group members and service accounts into Teams, then grant a Team access to apps scoped to specific environments. Environment keys are provisioned automatically when someone joins and revoked when they leave — with team-owned service accounts and optional role overrides. [Learn more about Teams](https://docs.phase.dev/access-control/teams) 03.2 — Role-based access control Managed and custom roles with a granular permission matrix, per-environment and per-path scoping, service accounts for machines. [Learn more about access control](https://docs.phase.dev/access-control) 03.3 — Network access policies Restrict access to your secrets by IP address or CIDR range with network access policies for users and service accounts. [Learn more about network policies](https://docs.phase.dev/access-control/network#network-access-policies) 03.4 — Audit logs & versioning Every CRUD operation logged with actor, source, and diff. Point-in-time rollback for any secret. [Learn more about audit logs](https://docs.phase.dev/console/apps#logs) SecurityS.01 – S.03 ## Trust, but verify Every control here is cryptographically enforced, independently audited, or open to inspection. S.01 ### Strong encryption End-to-end encryption for all secrets. High-entropy keys for every environment, user, agent and machine. Access is controlled by encryption keys that only you hold. [How it works](https://phase.dev/security/) XCHACHA20-POLY1305 · X25519 · ARGON2ID S.02 ### SOC 2 Type 2 Independently audited under SOC 2 Type 2, with controls examined continuously. Penetration tested regularly by Oneleet, an independent security firm. Reports are available in our trust center. ![SOC 2 Type 2](https://phase.dev/assets/soc2-certified-dark-badge.svg)[Trust center](https://trust.phase.dev/) SOC 2 TYPE 2 · EXTERNALLY PENTESTED S.03 ### No telemetry Every line of code that secures your secrets is public and auditable. Run on Phase Cloud or your own infrastructure: Docker, Kubernetes, any cloud, or fully air-gapped. No outbound usage analytics or telemetry. [Deploy guides](https://docs.phase.dev/self-hosting) AIR-GAPPABLE · PRIVATE · SELF-MANAGED E2EE by default · SOC 2 Type 2 · Pentested · Open source[Explore the security model](https://phase.dev/security/) PlatformBatteries included ## Batteries included. Global search, offline mode, dynamic secrets, machine identity. The parts of a secrets manager you would otherwise build yourself. ### Global secret search Find any secret across every app, environment and folder in your organization. Search runs client-side: values are never decrypted. [Docs](https://docs.phase.dev/console/secrets#global-secret-search) ### Work offline The CLI caches secrets locally, encrypted at rest. Set `PHASE_OFFLINE=1` and keep shipping when the network is down. [Docs](https://docs.phase.dev/cli/commands#offline-mode) ### Rotating secrets Phase mints, exposes, and revokes third-party credentials on a schedule — your app picks up fresh values with no code changes. [Docs](https://docs.phase.dev/console/rotating-secrets) ### Secret referencing Compose configuration from other secrets, across environments, folders and apps. References resolve at inject time. [Docs](https://docs.phase.dev/console/secrets#secret-referencing) ### Authentication for humans and machines External identities for workloads: no bootstrap credential to provision, rotate, or leak. SSO with SCIM provisioning for people. Machines — external identities Workloads authenticate with their platform identity: an AWS SigV4-signed request or an Azure managed-identity JWT. Phase verifies the identity upstream with AWS STS or Microsoft Entra, matches it against your trusted principals, and returns a short-lived scoped token straight to the workload. Humans — SSO Single sign-on through your identity provider. Users are provisioned and deprovisioned over SCIM v2: Entra ID, Okta, JumpCloud, or any compatible directory. [Docs](https://docs.phase.dev/access-control) ### Dynamic secrets Lease short-lived AWS IAM credentials on demand. Renew within the max TTL, or revoke instantly. [Docs](https://docs.phase.dev/console/dynamic-secrets) ### Audit logs Every management action captured org-wide — actor, timestamp, and before/after diffs — built for compliance and incident response. [Docs](https://docs.phase.dev/console/apps#logs) ### Sealed secrets Write-only secrets: once saved, the plaintext is never visible or editable in the UI again — ideal for signing keys and tokens. [Docs](https://docs.phase.dev/console/secrets#secret-types) ### Kubernetes Operator Declare a PhaseSecret and the operator keeps native Kubernetes secrets in sync, auto-redeploying your workloads on change. [Docs](https://docs.phase.dev/integrations/platforms/kubernetes) Stories ## Trusted by builders Engineers across a wide range of industries use Phase to build world-class software and secure critical infrastructure. #phase — field reports [![Shivam](https://phase.dev/assets/images/testimonials/shivam.jpg) ShivamLead Product Engineer @ Chatwoot#01 I tried out Phase a while back and was pretty impressed. The DX is amazing, especially the CLI. Managing secrets has been such a pain, I am definitely gonna use Phase for projects I work on going forward. … Super easy for me to recommend it to my peers.](https://www.producthunt.com/products/phase-5/reviews?review=117158)[![Ash](https://phase.dev/assets/images/testimonials/ash.jpg) AshSecurity Services Team Lead @ Arctic Wolf#02 Phase has one of the most well thought out security architectures I've seen. The encryption implementation is one I show my students as a benchmark for robust cryptography in a real-world application.](https://www.linkedin.com/in/ash-ranganath/)[![Mary](https://phase.dev/assets/images/testimonials/mary.avif) MaryCo-founder @ Voxify#03 Phase looks like a solid tool for managing secrets in a secure and efficient way. I've used similar tools, but the ease of integration with other services like GitHub and AWS really sets this apart.](https://www.producthunt.com/products/phase-5/launches/phase-8?comment=3805051)[![Nicola](https://phase.dev/assets/images/testimonials/nicola.avif) NicolaSenior Frontend Developer @Tiledesk#04 Phase is a valuable resource for any engineering team looking to improve their security practices and deployment processes. Highly recommended for those looking for robust solutions!](https://www.producthunt.com/posts/phase-8?comment=3807193)[![Christofer](https://phase.dev/assets/images/testimonials/christofer.avif) ChristoferMailfox#05 This is a great tool. When you work with a distributed team it is always a real pain to share secrets and credentials. I also love the fact that you offer a self-hosted version. Especially in Europe a lot of companies insist on hosting on premise 😅](https://www.producthunt.com/products/phase-5/launches/phase-8?comment=3804686)[![Max](https://phase.dev/assets/images/testimonials/max.jpg) MaxSystems Engineer @ Defined Once#06 Great work with Phase, such a delightful piece of software.](https://github.com/phasehq/console/issues/267#issuecomment-3696578404)[![Elias](https://phase.dev/assets/images/testimonials/elias.jpg) EliasSystems Engineer @ LJZ Digital Solutions#07 Great work with Phase, it's a blast to use.](https://github.com/phasehq/console/issues/728)[![Yuki](https://phase.dev/assets/images/testimonials/yuki.jpg) YukiMorph#08 Awesome one. This is what I've been looking for!](https://www.producthunt.com/products/phase-5/launches/phase-6?comment=2875662)[![Numan](https://phase.dev/assets/images/testimonials/numan.jpg) NumanWeb Developer#09 We have started using phase to inject secrets into our deployment app… Awesome product btw](https://github.com/phasehq/cli/issues/266) [![Shivam](https://phase.dev/assets/images/testimonials/shivam.jpg) Shivam Lead Product Engineer @ Chatwoot I tried out Phase a while back and was pretty impressed. The DX is amazing, especially the CLI. Managing secrets has been such a pain, I am definitely gonna use Phase for projects I work on going forward. … Super easy for me to recommend it to my peers.](https://www.producthunt.com/products/phase-5/reviews?review=117158)[![Ash](https://phase.dev/assets/images/testimonials/ash.jpg) Ash Security Services Team Lead @ Arctic Wolf Phase has one of the most well thought out security architectures I've seen. The encryption implementation is one I show my students as a benchmark for robust cryptography in a real-world application.](https://www.linkedin.com/in/ash-ranganath/)[![Mary](https://phase.dev/assets/images/testimonials/mary.avif) Mary Co-founder @ Voxify Phase looks like a solid tool for managing secrets in a secure and efficient way. I've used similar tools, but the ease of integration with other services like GitHub and AWS really sets this apart.](https://www.producthunt.com/products/phase-5/launches/phase-8?comment=3805051)[![Nicola](https://phase.dev/assets/images/testimonials/nicola.avif) Nicola Senior Frontend Developer @Tiledesk Phase is a valuable resource for any engineering team looking to improve their security practices and deployment processes. Highly recommended for those looking for robust solutions!](https://www.producthunt.com/posts/phase-8?comment=3807193)[![Christofer](https://phase.dev/assets/images/testimonials/christofer.avif) Christofer Mailfox This is a great tool. When you work with a distributed team it is always a real pain to share secrets and credentials. I also love the fact that you offer a self-hosted version. Especially in Europe a lot of companies insist on hosting on premise 😅](https://www.producthunt.com/products/phase-5/launches/phase-8?comment=3804686)[![Max](https://phase.dev/assets/images/testimonials/max.jpg) Max Systems Engineer @ Defined Once Great work with Phase, such a delightful piece of software.](https://github.com/phasehq/console/issues/267#issuecomment-3696578404)[![Elias](https://phase.dev/assets/images/testimonials/elias.jpg) Elias Systems Engineer @ LJZ Digital Solutions Great work with Phase, it's a blast to use.](https://github.com/phasehq/console/issues/728)[![Yuki](https://phase.dev/assets/images/testimonials/yuki.jpg) Yuki Morph Awesome one. This is what I've been looking for!](https://www.producthunt.com/products/phase-5/launches/phase-6?comment=2875662)[![Numan](https://phase.dev/assets/images/testimonials/numan.jpg) Numan Web Developer We have started using phase to inject secrets into our deployment app… Awesome product btw](https://github.com/phasehq/cli/issues/266) ChangelogLatest updates ## Changelog Built with and for our users. [Community contributors](https://github.com/phasehq/console) [GitHub](https://github.com/phasehq/console) [2026.09.01Account Management, Log Streams & moresecurityconsolecli](https://phase.dev/changelog/account-management-log-streams/)[2026.07.02Rotated secrets, Tailscale integration & Kubernetes Operator v2.0consolesecretsrotation](https://phase.dev/changelog/automated-secret-rotation/)[2026.06.04Teams, SCIM, Platform APIs & Audit Logsconsoleaccess-controlteams](https://phase.dev/changelog/teams-scim-apis-audit-logs/)[Read more](https://phase.dev/changelog/) DeploymentSelf-hosted / Cloud Get started ## Keep your secrets Self-host or start on fully managed Cloud in under a minute. Self-hosted Run Phase on your own infrastructure. Free and open source. AI agent deployment skill [![Docker Compose logo](https://phase.dev/assets/images/docker.svg)](https://docs.phase.dev/self-hosting/docker-compose)[![Kubernetes logo](https://phase.dev/assets/images/kubernetes.svg)](https://docs.phase.dev/self-hosting/kubernetes)[![AWS logo](https://phase.dev/assets/images/aws.svg)](https://docs.phase.dev/self-hosting/aws-eks)[![GCP logo](https://phase.dev/assets/images/gcp.svg)](https://docs.phase.dev/self-hosting/gcp)[![Azure logo](https://phase.dev/assets/images/azure.svg)](https://docs.phase.dev/self-hosting/azure)[![Railway logo](https://phase.dev/assets/images/railway.svg)](https://docs.phase.dev/self-hosting/railway)[![Raspberry Pi logo](https://phase.dev/assets/images/raspberry.svg)](https://docs.phase.dev/self-hosting/raspberrypi) [Self-hosting guide](https://docs.phase.dev/self-hosting) Cloud Fully managed. From signup to your first secret in 60 seconds. Sign up with [Google](https://console.phase.dev/login?provider=google)[GitHub](https://console.phase.dev/login?provider=github)[GitLab](https://console.phase.dev/login?provider=gitlab)