Skip to main content
The Phala Cloud CLI (phala) is a command-line tool for deploying and managing Confidential Virtual Machines (CVMs) on Phala Cloud. It is also available as the pha alias.

​
Install

npm install -g phala
Or run without installing: npx phala / bunx phala

​
Get Started

Follow the Deploy Your First CVM tutorial to deploy a Jupyter notebook and test TEE functions in under 10 minutes.

​
API Versioning

The CLI communicates with the Phala Cloud API using header-based versioning. The current default API version is 2026-01-21. The CLI sends an X-Phala-Version header with every request. This determines the response format returned by the server. See the JS SDK API Versioning page for details on version differences.
VersionStatus
2026-01-21Default (current)
2025-10-28Legacy
You can override the API version with the --api-version global flag (added in v1.1.12): 
phala apps --api-version 2025-10-28

​
Authentication

CommandDescription
loginAuthenticate with Phala Cloud
logoutRemove stored API key
statusCheck authentication status
whoamiPrint the current user
profilesList auth profiles
switchSwitch auth profiles

​
Deployment

CommandDescription
deployDeploy new CVM or update existing one
instance-typesList available instance types

​
App Management

CommandDescription
appsList deployed CVMs
cvmsManage CVMs (start, stop, restart, delete, resize, …)
linkLink a local directory to a CVM
nodesList TEE worker nodes
ssh-keysManage SSH keys (list, add, remove, import from GitHub)

​
CVM Operations

CommandDescription
logsFetch logs from a CVM (container, serial, stdout/stderr)
psList containers of a CVM
sshConnect to a CVM via SSH
cpCopy files to/from a CVM via SCP
runtime-configShow CVM runtime configuration

​
Advanced

CommandDescription
apiMake authenticated API requests
selfCLI self-management (update)
simulatorLocal TEE simulator for development
completionGenerate shell completion scripts

​
Deprecated

These commands are deprecated and will be removed in a future release.
CommandUse instead
authlogin, logout, status
configProfile-based credentials (~/.phala-cloud/credentials.json)
dockerStandard docker CLI for build/push
cvms createdeploy
cvms upgradedeploy --cvm-id <id>
cvms logslogs
cvms serial-logslogs --serial
Deprecated deploy options:
OptionUse instead
--vcpu, --memory--instance-type
--env-file-e
--kms-id, --uuid--custom-app-id

​
Profiles & Credentials

The CLI supports multiple authentication profiles stored in ~/.phala-cloud/credentials.json. Each profile stores:
FieldDescription
tokenAPI key
api_prefixAPI base URL
workspaceLinked workspace (name + slug)
userLinked user (username + email)
updated_atLast update timestamp
Use profiles to list profiles and switch to change the active profile.

​
Environment Variables

VariableDescription
PHALA_CLOUD_API_KEYOverride the stored API key
PHALA_CLOUD_API_PREFIXOverride the API base URL
PHALA_CLOUD_DIROverride the credentials directory (default: ~/.phala-cloud)
PHALA_UPDATE_CHANNELRelease channel for self update (e.g., latest, beta)

​
Configuration

Credentials are stored in ~/.phala-cloud/credentials.json (schema version 1, supports multiple profiles). Project-level configuration is in phala.toml in the working directory. Supported fields:
FieldTypeDescription
id / uuid / app_id / instance_id / namestringCVM identifier (any format)
profilestringAuth profile to use for this project
gateway_domainstringCustom gateway domain
gateway_portnumberCustom gateway port
compose_filestringPath to Docker Compose file
env_filestringPath to .env file
public_logsbooleanMake container logs public
public_sysinfobooleanMake system info public
listedbooleanList CVM in the public directory
Example phala.toml: 
id = "cvm-abc123"
profile = "production"
compose_file = "docker-compose.yml"
env_file = ".env"
public_logs = true

​
Global Flags

FlagDescription
--jsonOutput in JSON format for programmatic use
--api-token <token>Override the stored API key for this command
--api-version <version>Override the API version (e.g., 2025-10-28, 2026-01-21). Added in v1.1.12