Phala Cloud Documentation — Confidential AI on TEE

phala envs <command> [options]

Encrypt and update CVM sealed environment variables

Option	Description
`-h, --help`	Show help information for the current command
`-v, --version`	Show CLI version
`--api-token TOKEN, --api-key TOKEN`	API token for authenticating with Phala Cloud
`-j, --json, --no-json`	Output in JSON format
`--interactive`	Enable interactive mode for commands that support it
`--cvm-id <value>`	CVM identifier (UUID, app_id, instance_id, or name)
`--profile PROFILE`	Temporarily use a different auth profile for this command
`--api-version <value>`	API version to use (e.g. 2025-10-28, 2026-01-21)

phala envs --help

Command	Description
`encrypt`	Encrypt environment variables for a CVM (sealed, only readable inside TEE)
`update`	Encrypt and push sealed environment variables to a CVM (only readable inside TEE)