Skip to main content

​
getAppEnvEncryptPubKey

GET /kms/{kms}/pubkey/{app_id} Retrieves the encryption public key managed by a KMS instance for a specific app. This key is used to encrypt environment variables before sending them to the Phala Cloud API. For PHALA KMS, the public key is returned directly in the provisionCvm response as app_env_encrypt_pubkey. You only need to call this function explicitly when using on-chain KMS (ETHEREUM/BASE), where the app ID comes from deploying a contract. Parameters:
FieldTypeRequiredDescription
kmsstringYesKMS ID or slug
app_idstringYesApp ID (40 hex chars, optional 0x prefix)
Returns: GetAppEnvEncryptPubKey
FieldTypeDescription
public_keystringRSA public key for encrypting env vars
signaturestringKMS signature over the public key
Example: 
import { encryptEnvVars, parseEnvVars } from "@phala/cloud";

// Get the encryption key from KMS
const { public_key } = await client.getAppEnvEncryptPubKey({
  kms: "ethereum-mainnet",
  app_id: "0x1234abcd...",
});

// Encrypt environment variables
const envVars = parseEnvVars("API_KEY=secret\nDB_URL=postgres://...");
const encrypted = await encryptEnvVars(envVars, public_key);

// Use the encrypted env in commitCvmProvision or updateCvmEnvs
await client.commitCvmProvision({
  app_id: "0x1234abcd...",
  compose_hash: provision.compose_hash,
  encrypted_env: encrypted,
  env_keys: ["API_KEY", "DB_URL"],
});

​
safeGetAppEnvEncryptPubKey

Safe variant that returns a SafeResult<GetAppEnvEncryptPubKey> instead of throwing on errors.