# Phase (slim)

> Phase is an open-source secrets manager from Phi Security Inc. with end-to-end encryption, service accounts, secret rotation and audit logs. Agents reach it through a REST API, a CLI and SDKs, on Phase Cloud or self-hosted.

- Full: https://www.anchorterminal.com/tools/phase.md (~7,150 tokens) · this version ~1,630 tokens · JSON https://www.anchorterminal.com/tools/phase.json · canonical https://www.anchorterminal.com/tools/phase
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-08

**B · 68/100 · rank #194 of 722 · #10 in Secrets & credential vaults · not agent-ready · confidence medium**


Assessment: Service account tokens can be minted with an expiry over the API, every secret read is logged, and the CLI redacts values when it detects an AI agent. No OpenAPI document or pagination was found in the reviewed documentation, and the Free plan keeps audit logs for 24 hours.

## Facts

- Kind: HTTP API · vendor: Phi Security Inc. · category: Secrets & credential vaults · legal entity: Phi Security Inc. · provenance 87/100
- Endpoint: `https://api.phase.dev` (HTTP)
- Auth: OAuth or key · pricing: Freemium · x402: no · licence: MIT outside the `ee/` directories, which are under the proprietary Phase Console Enterprise licence
- Probe metrics: not measured yet (probes haven't run)
- Surface graded: Phase Cloud's REST API at `https://api.phase.dev` and the Phase CLI. There is no MCP server. Self-hosted instances serve the same API at `/service/public`
- Free tier: 5 users or service accounts, 3 apps, 3 environments, 24-hour audit logs, 120 requests a minute
- Paid plans: Pro $10 and Enterprise $25 a user a month, 14-day trial, service accounts free
- Rate limits: Free 120 and Pro 240 requests a minute per account, Enterprise custom, 429 with `retry-after`. Self-hosted has none by default
- Machine identity: Service accounts with expiring tokens, AWS IAM and Azure external identities, network access policies on Pro
- Agent integration: `phase ai enable` installs a skill for Claude Code, Cursor, VS Code Copilot, Codex and OpenCode, with value masking
- SDKs: Go (`github.com/phasehq/golang-sdk`), Node (`@phase.dev/phase-node` 3.2.0, October 2025), Python (`phase-dev` 2.1.2, April 2025), browser JS
- Hosting: Phase Cloud on AWS eu-central-1 (Frankfurt), or self-hosted with Docker Compose, Kubernetes, AWS, Azure, GCP or Railway
- Audit logs: Free 24 hours, Pro 90 days, Enterprise custom with log streams to Datadog
- Prices: Pro plan $10 per seat per month; Enterprise plan $25 per seat per month

- Scores: Reliability 91, Performance pending, Schema & documentation 58, Agent ergonomics 56, Security & auth 83, Payments & pricing 25, Task success pending, Maintenance & community 83, Transparency & trust 73 · total over the 7 assessed categories
- Why: Reliability, Graded as a hosted service, Phase Cloud. · Schema & documentation, No OpenAPI or other machine-readable contract was found in the docs or the repositories (0). · Agent ergonomics, `GET /v1/secrets` filters by path, key and tags, and the CLI skill is one document, but there is no field selection or names-only read (15 o… · Security & auth, Service account tokens take an expiry, can be deleted, and inherit the account's role and its apps and environments. · Payments & pricing, Graded on the hosted option. · Maintenance & community, Console v2.77.2 was released on 4 October 2026, four days before this check, and a v2.77.3 version bump was merged on 8 October (30). · Transparency & trust, MIT outside the `ee/` directories, with billing, licensing and some access and integration code under a proprietary enterprise licence (24 o…
- Sources: 22, open questions: 7, both in the full twin
- Capabilities: secrets.store, secrets.machine-identity, secrets.audit, secrets.self-host, secrets.rotate
- JSON: https://www.anchorterminal.com/api/v1/tools/phase.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/phase.svg` or a link to https://www.anchorterminal.com/tools/phase from a page on phase.dev or one of its subdomains, or the README of github.com/phasehq/console, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Enable server-side encryption on the app before calling `/v1/secrets`. Without it the REST API cannot read or write that app's secrets
2. Send `Authorization: Bearer ServiceAccount <token>` for a service account and `Bearer User <token>` for a personal access token. The token type is part of the header
3. Stay under 120 requests a minute per account on Free and 240 on Pro, and wait the seconds in the `retry-after` header on a 429
4. Treat a 409 on `POST /v1/secrets` as the key already existing at that path, and use `PUT` to change it. Rotating secrets reject `PUT` and `DELETE`
5. Have a person run `phase ai enable` and choose masked values. The CLI blocks an agent from running `phase ai enable` or `phase ai disable` itself

## Connect

```bash
curl -fsSL https://pkg.phase.dev/install.sh | sh   # or: brew tap phasehq/cli && brew install phase
```

```bash
curl -G https://api.phase.dev/v1/secrets/ -H "Authorization: Bearer ServiceAccount $PHASE_TOKEN" \
  -d app_id=$PHASE_APP_ID -d env=development
```

```bash
phase ai enable
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/phase

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Infisical | A | 83.7 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit, secrets.self-host | https://www.anchorterminal.com/tools/infisical.min.md |
| HashiCorp Vault + Vault MCP Server | B | 64.2 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit, secrets.self-host | https://www.anchorterminal.com/tools/hashicorp-vault.min.md |
| AWS Secrets Manager | BB | 77.7 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | https://www.anchorterminal.com/tools/aws-secrets-manager.min.md |
| Google Cloud Secret Manager | BB | 76.5 | secrets.store, secrets.rotate, secrets.machine-identity, secrets.audit | https://www.anchorterminal.com/tools/google-secret-manager.min.md |
| Azure Key Vault | BB | 74.7 | secrets.store, secrets.machine-identity, secrets.audit, secrets.rotate | https://www.anchorterminal.com/tools/azure-key-vault.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)