> ## Documentation Index
> Fetch the complete documentation index at: https://docs.phala.com/llms.txt
> Use this file to discover all available pages before exploring further.

# envs update

> Encrypt and push sealed environment variables to a CVM (only readable inside TEE)

## Command: `phala envs update`

### Syntax

```
phala envs update [options] [<cvm_id>]
```

### Description

Encrypt and push sealed environment variables to a CVM (only readable inside TEE)

### Arguments

| Argument    | Description                                           |
| ----------- | ----------------------------------------------------- |
| `<cvm_id>?` | CVM identifier (UUID, app\_id, instance\_id, or name) |

### Options

| Option                    | Description                                                                   |
| ------------------------- | ----------------------------------------------------------------------------- |
| `-e, --env <value>`       | Environment variable (KEY=VALUE) or env file path (repeatable)                |
| `--encrypted-env <value>` | Pre-encrypted environment variables as hex string (from 'phala envs encrypt') |

### Advanced Options

| Option                  | Description                                                                 |
| ----------------------- | --------------------------------------------------------------------------- |
| `--private-key <value>` | Private key for signing on-chain transactions (or set PRIVATE\_KEY env var) |
| `--rpc-url <value>`     | RPC URL for on-chain KMS transactions (or set ETH\_RPC\_URL env var)        |

### Global Options

| Option                               | Description                                               |
| ------------------------------------ | --------------------------------------------------------- |
| `-h, --help`                         | Show help information for the current command             |
| `-v, --version`                      | Show CLI version                                          |
| `--api-token TOKEN, --api-key TOKEN` | API token for authenticating with Phala Cloud             |
| `-j, --json, --no-json`              | Output in JSON format                                     |
| `-i, --interactive`                  | Enable interactive mode                                   |
| `--cvm-id <value>`                   | CVM identifier (UUID, app\_id, instance\_id, or name)     |
| `--profile PROFILE`                  | Temporarily use a different auth profile for this command |
| `--api-version <value>`              | API version to use (e.g. 2025-10-28, 2026-01-21)          |

### Examples

* Update with inline variables

```bash theme={"system"}
phala envs update app_abc123 -e SECRET=newvalue -e API_KEY=xxx
```

* Update from env file

```bash theme={"system"}
phala envs update app_abc123 -e .env.production
```

* Update with CVM from phala.toml

```bash theme={"system"}
phala envs update -e .env
```

* Update with pre-encrypted hex (from 'phala envs encrypt')

```bash theme={"system"}
phala envs update app_abc123 --encrypted-env $(phala envs encrypt app_abc123 -e .env)
```

* Update with on-chain KMS

```bash theme={"system"}
phala envs update app_abc123 -e .env --private-key <key>
```