> ## Documentation Index
> Fetch the complete documentation index at: https://phaseo.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Phaseo Gateway base URL: https://api.phaseo.app/v1. Send `Authorization: Bearer $PHASEO_API_KEY` with every request.
> Model IDs look like `provider/model`, for example `openai/gpt-6-astra`. Do not guess IDs: list them with `GET /v1/models` or check https://phaseo.app/models. `phaseo/free` routes to an available free model and needs no wallet balance.
> For new text integrations prefer `POST /v1/responses`. `POST /v1/chat/completions` (OpenAI format) and `POST /v1/messages` (Anthropic format) suit existing code.
> The full API contract is https://phaseo.app/docs/openapi/v1/openapi.yaml. Official SDKs: `@phaseo/sdk` (TypeScript) and `phaseo` (Python), plus Go, C#, PHP, Ruby and Rust.
> Search these docs over MCP at https://phaseo.app/docs/mcp, and install Phaseo skills with `npx skills add https://phaseo.app/docs`. If a page is wrong or out of date, report it with the MCP `submit_feedback` tool.
> Manage Phaseo accounts with the `phaseo` CLI (`npm install -g @phaseo/cli`, then `phaseo login` or `phaseo login --device-code`), the `/v1` Management API or the MCP server at `https://mcp.phaseo.app/mcp?access=manage`. Do not send users to the dashboard for account tasks. A person is still needed for sign-up, approving a sign-in, paying the first top-up on the checkout link that `phaseo credits add` returns when no card is saved, confirming each saved-card top-up from the emailed link, and account security (password, MFA, passkeys). Create API keys with `phaseo keys create --name <name> --json`; never guess one. Credit top-ups need `phaseo login --scopes billing:write` first. Task map: https://phaseo.app/docs/v1/developers/manage-from-an-agent.md.

# Infisical

> Prepare automatic Phaseo API key rotation with Infisical.

Infisical can rotate Phaseo Gateway API keys by authenticating with a scoped Phaseo Management API key. Phaseo already exposes the key lifecycle required for dual-phase, zero-downtime rotation.

> [!WARNING]
>
> Phaseo is not yet a selectable App Connection in Infisical. This page documents the supported Phaseo contract and the configuration to use once the Infisical connection is available.

## How rotation works

1. Infisical authenticates to Phaseo with a Management API key.
2. Infisical creates a replacement Gateway API key with `POST /v1/keys`.
3. Infisical stores the returned plaintext key in the configured secret.
4. The application begins using the replacement key.
5. Infisical revokes the previous key with `DELETE /v1/keys/{id}`.

Phaseo returns a Gateway API key's plaintext value only when it is created. The old and replacement keys can overlap while the secret is updated.

## Create a scoped Management API key

In **Dashboard → Settings → Management Keys**, create a key with these capabilities:

* `keys:read` to validate the connection and inspect managed keys
* `keys:write` to create replacement keys
* `keys:delete` to revoke previous keys

Store the resulting `phaseo_v1_mk_...` secret in Infisical. Management API keys are control-plane credentials and cannot be used for inference.

## Connection details

| Field | Value |
| - | - |
| Base URL | `https://api.phaseo.app/v1` |
| Authentication | `Authorization: Bearer <PHASEO_MANAGEMENT_KEY>` |
| Validate | `GET /keys` |
| List Gateway keys | `GET /keys` |
| Create Gateway key | `POST /keys` |
| Revoke Gateway key | `DELETE /keys/{id}` |

## Create a rotated key

```bash theme={null}
curl https://api.phaseo.app/v1/keys \
  -H "Authorization: Bearer $PHASEO_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "infisical-production",
    "limit": 100,
    "limit_reset": "monthly",
    "include_byok_in_limit": false
  }'
```

The response contains the new Gateway key once in `data.key`, plus its stable identifier in `data.id`.

## Revoke the previous key

```bash theme={null}
curl -X DELETE https://api.phaseo.app/v1/keys/$PREVIOUS_KEY_ID \
  -H "Authorization: Bearer $PHASEO_MANAGEMENT_KEY"
```

Deletion is idempotent. A key that is already deleted returns a successful deleted state, which makes rotation retries safe.

## Limits and BYOK

Phaseo accepts the compatibility fields `limit`, `limit_reset`, and `include_byok_in_limit`. Supported reset periods are daily, weekly, and monthly. `include_byok_in_limit` is currently compatibility-only; Phaseo excludes BYOK usage from this key-limit field.

## Partner status

A native Infisical connection requires a Phaseo App Connection and Phaseo API Key Rotation implementation to be accepted into Infisical. Phaseo's management and key lifecycle APIs are already available; the remaining work is the Infisical-side connector, tests, UI entry, and documentation.

## Related

* [Management API Keys](https://phaseo.app/docs/v1/developers/management-api-keys.md)
* [Create API key](https://phaseo.app/docs/v1/api-reference/endpoint/keys-create.md)
* [Delete API key](https://phaseo.app/docs/v1/api-reference/endpoint/keys-delete.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.