Integrations

Integrations in Phase allow you to automatically sync secrets from your Environments to third-party platforms and services. When secrets change, connected integrations are triggered automatically — keeping your external services in sync without manual intervention.

How Integrations Work

Integrations connect at the Environment level within an App. When you set up an integration, you select:

1. The target service — Where secrets should be synced to
2. The source Environment — Which Environment's secrets to sync from
3. The secrets to sync — Optionally filter which secrets are included

Once configured, any change to secrets in that Environment (create, update, or delete) automatically triggers a sync to all connected integrations. This ensures your external platforms always have the latest secret values.

Requirements

Server-Side Encryption (SSE)

All sync integrations require SSE to be enabled on the App. This is because the Phase server needs to decrypt secrets in order to push them to external services. Without SSE, the server cannot access secret values and syncing is not possible.

Integration Credentials

Most integrations require credentials to authenticate with the target service. These are stored as Integration Credentials at the Organisation level and can be reused across multiple integrations. Examples include:

• AWS access keys or IAM role ARNs
• GitHub OAuth connections or fine-grained personal access tokens
• Vercel API tokens
• Azure service principal credentials

Integration Credentials are managed separately from your application secrets and are subject to their own RBAC permissions.

Secret References

When syncing secrets that use cross-environment or cross-application references, all referenced secrets must be resolvable. If a reference points to a secret that doesn't exist or an App without SSE enabled, the sync will fail. This is by design — Phase never pushes broken or unresolved references to third-party platforms.

Supported Platforms

Phase supports syncing to a wide range of platforms across several categories:

CI/CD

Cloud Providers

Containers & Orchestration

Hosting & Deployment

Sync Behaviour

Automatic Triggering

Syncs are triggered automatically whenever secrets in the connected Environment are deployed. This includes:

• Creating new secrets
• Updating existing secret values
• Deleting secrets
• Changes propagated from secret references

Failure Handling

If a sync fails (due to invalid credentials, network issues, or unresolvable references), the failure is recorded in the sync's logs, which you can view from the sync card in the App's Syncing tab. The secrets in Phase remain unaffected — a sync failure does not roll back changes to your secrets.

One-Way Sync

Integrations are one-way: secrets flow from Phase to the target platform. Changes made directly on the target platform are not synced back to Phase and may be overwritten on the next sync.

Managing Integrations

Integrations can be configured from the Syncing tab within an App in the Phase Console. Each integration has its own setup guide — see the individual platform pages linked above for specific configuration steps.