Phala Cloud Documentation — Confidential AI on TEE

Command: `phala envs update`

phala envs update [options] [<cvm_id>]

Encrypt and push sealed environment variables to a CVM (only readable inside TEE)

Argument	Description
`<cvm_id>?`	CVM identifier (UUID, app_id, instance_id, or name)

Option	Description
`-e, --env <value>`	Environment variable (KEY=VALUE) or env file path (repeatable)
`--encrypted-env <value>`	Pre-encrypted environment variables as hex string (from ‘phala envs encrypt’)

Option	Description
`--private-key <value>`	Private key for signing on-chain transactions (or set PRIVATE_KEY env var)
`--rpc-url <value>`	RPC URL for on-chain KMS transactions (or set ETH_RPC_URL env var)

Option	Description
`-h, --help`	Show help information for the current command
`-v, --version`	Show CLI version
`--api-token TOKEN, --api-key TOKEN`	API token for authenticating with Phala Cloud
`-j, --json, --no-json`	Output in JSON format
`-i, --interactive`	Enable interactive mode
`--cvm-id <value>`	CVM identifier (UUID, app_id, instance_id, or name)
`--profile PROFILE`	Temporarily use a different auth profile for this command
`--api-version <value>`	API version to use (e.g. 2025-10-28, 2026-01-21)

phala envs update app_abc123 -e SECRET=newvalue -e API_KEY=xxx

phala envs update app_abc123 -e .env.production

phala envs update -e .env

phala envs update app_abc123 --encrypted-env $(phala envs encrypt app_abc123 -e .env)

phala envs update app_abc123 -e .env --private-key <key>