Skip to main content

​
Command: phala envs encrypt

​
Syntax

phala envs encrypt [options] [<cvm_id>]

​
Description

Encrypt environment variables for a CVM (sealed, only readable inside TEE)

​
Arguments

ArgumentDescription
<cvm_id>?CVM identifier (UUID, app_id, instance_id, or name)

​
Options

OptionDescription
-e, --env <value>Environment variable (KEY=VALUE) or env file path (repeatable)
-n, --no-newlineDo not print trailing newline (useful for piping)

​
Global Options

OptionDescription
-h, --helpShow help information for the current command
-v, --versionShow CLI version
--api-token TOKEN, --api-key TOKENAPI token for authenticating with Phala Cloud
-j, --json, --no-jsonOutput in JSON format
-i, --interactiveEnable interactive mode
--cvm-id <value>CVM identifier (UUID, app_id, instance_id, or name)
--profile PROFILETemporarily use a different auth profile for this command
--api-version <value>API version to use (e.g. 2025-10-28, 2026-01-21)

​
Examples

  • Encrypt inline variables
phala envs encrypt app_abc123 -e SECRET=value -e API_KEY=xxx
  • Encrypt from env file
phala envs encrypt app_abc123 -e .env
  • Encrypt with CVM from phala.toml
phala envs encrypt -e .env.production
  • Pipe to file for later use
phala envs encrypt app_abc123 -e .env > encrypted.hex
  • Pipe without trailing newline
phala envs encrypt app_abc123 -n -e .env | some-tool