Command: phala envs update
Syntax
Description
Encrypt and push sealed environment variables to a CVM (only readable inside TEE)Arguments
| Argument | Description |
|---|---|
<cvm_id>? | CVM identifier (UUID, app_id, instance_id, or name) |
Options
| Option | Description |
|---|---|
-e, --env <value> | Environment variable (KEY=VALUE) or env file path (repeatable) |
--encrypted-env <value> | Pre-encrypted environment variables as hex string (from ‘phala envs encrypt’) |
Advanced Options
| Option | Description |
|---|---|
--private-key <value> | Private key for signing on-chain transactions (or set PRIVATE_KEY env var) |
--rpc-url <value> | RPC URL for on-chain KMS transactions (or set ETH_RPC_URL env var) |
Global Options
| Option | Description |
|---|---|
-h, --help | Show help information for the current command |
-v, --version | Show CLI version |
--api-token TOKEN, --api-key TOKEN | API token for authenticating with Phala Cloud |
-j, --json, --no-json | Output in JSON format |
-i, --interactive | Enable interactive mode |
--cvm-id <value> | CVM identifier (UUID, app_id, instance_id, or name) |
--profile PROFILE | Temporarily use a different auth profile for this command |
--api-version <value> | API version to use (e.g. 2025-10-28, 2026-01-21) |
Examples
- Update with inline variables
- Update from env file
- Update with CVM from phala.toml
- Update with pre-encrypted hex (from ‘phala envs encrypt’)
- Update with on-chain KMS