diff --git a/CHANGELOG.md b/CHANGELOG.md
index 05e9705f0b..2a23577c28 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ This is the log of notable changes to EAS CLI and related packages.
 
 ### 🎉 New features
 
+- [eas-cli] Add `eas env:set`, which creates or updates an environment variable in one command. `eas env:create` and `eas env:update` are now deprecated. ([#4002](https://github.com/expo/eas-cli/pull/4002) by [@jonsamp](https://github.com/jonsamp))
 - [eas-cli] Improve `eas workflow:create`: add a `--template` flag, generate a placeholder workflow when a file name is passed, use shorter default file names (`build.yml`, `update.yml`, `deploy.yml`), configure EAS Build and EAS Update automatically when the chosen template requires them, set default app identifiers without prompting for the development build and deploy templates, install `expo-dev-client` during development build setup, and tighten the generated comments and next steps. ([#3943](https://github.com/expo/eas-cli/pull/3943) by [@jonsamp](https://github.com/jonsamp))
 - [eas-cli] `eas integrations:posthog:dashboard` now opens PostHog via a signed-in link, skipping the login prompt. ([#3975](https://github.com/expo/eas-cli/pull/3975) by [@gwdp](https://github.com/gwdp))
 
diff --git a/packages/eas-cli/README.md b/packages/eas-cli/README.md
index c8cb078357..e79a6904ec 100644
--- a/packages/eas-cli/README.md
+++ b/packages/eas-cli/README.md
@@ -112,6 +112,7 @@ eas --help COMMAND
 * [`eas env:list [ENVIRONMENT]`](#eas-envlist-environment)
 * [`eas env:pull [ENVIRONMENT]`](#eas-envpull-environment)
 * [`eas env:push [ENVIRONMENT]`](#eas-envpush-environment)
+* [`eas env:set [ENVIRONMENT]`](#eas-envset-environment)
 * [`eas env:update [ENVIRONMENT]`](#eas-envupdate-environment)
 * [`eas fingerprint:compare [HASH1] [HASH2]`](#eas-fingerprintcompare-hash1-hash2)
 * [`eas fingerprint:generate`](#eas-fingerprintgenerate)
@@ -1316,7 +1317,7 @@ _See code: [packages/eas-cli/src/commands/diagnostics.ts](https://github.com/exp
 
 ## `eas env:create [ENVIRONMENT]`
 
-create an environment variable for the current project or account
+create an environment variable for the current project or account (deprecated, use eas env:set)
 
 ```
 USAGE
@@ -1341,7 +1342,7 @@ FLAGS
                             <options: plaintext|sensitive|secret>
 
 DESCRIPTION
-  create an environment variable for the current project or account
+  create an environment variable for the current project or account (deprecated, use eas env:set)
 ```
 
 _See code: [packages/eas-cli/src/commands/env/create.ts](https://github.com/expo/eas-cli/blob/v20.5.1/packages/eas-cli/src/commands/env/create.ts)_
@@ -1495,9 +1496,41 @@ DESCRIPTION
 
 _See code: [packages/eas-cli/src/commands/env/push.ts](https://github.com/expo/eas-cli/blob/v20.5.1/packages/eas-cli/src/commands/env/push.ts)_
 
+## `eas env:set [ENVIRONMENT]`
+
+set (create or update) an environment variable on the current project or account
+
+```
+USAGE
+  $ eas env:set [ENVIRONMENT] [--name <value>] [--value <value>] [--type string|file] [--visibility
+    plaintext|sensitive|secret] [--scope project|account] [--environment <value>...] [--json] [--non-interactive]
+
+ARGUMENTS
+  [ENVIRONMENT]  Environment to set the variable in. Default environments are 'production', 'preview', and
+                 'development'.
+
+FLAGS
+  --environment=<value>...  Environment variable's environment, e.g. 'production', 'preview', 'development'
+  --json                    Enable JSON output, non-JSON messages will be printed to stderr. Implies --non-interactive.
+  --name=<value>            Name of the variable
+  --non-interactive         Run the command in non-interactive mode.
+  --scope=<option>          [default: project] Scope for the variable
+                            <options: project|account>
+  --type=<option>           The type of variable
+                            <options: string|file>
+  --value=<value>           Text value of the variable
+  --visibility=<option>     Visibility of the variable
+                            <options: plaintext|sensitive|secret>
+
+DESCRIPTION
+  set (create or update) an environment variable on the current project or account
+```
+
+_See code: [packages/eas-cli/src/commands/env/set.ts](https://github.com/expo/eas-cli/blob/v20.5.1/packages/eas-cli/src/commands/env/set.ts)_
+
 ## `eas env:update [ENVIRONMENT]`
 
-update an environment variable on the current project or account
+update an environment variable on the current project or account (deprecated, use eas env:set)
 
 ```
 USAGE
@@ -1524,7 +1557,7 @@ FLAGS
                                   <options: plaintext|sensitive|secret>
 
 DESCRIPTION
-  update an environment variable on the current project or account
+  update an environment variable on the current project or account (deprecated, use eas env:set)
 ```
 
 _See code: [packages/eas-cli/src/commands/env/update.ts](https://github.com/expo/eas-cli/blob/v20.5.1/packages/eas-cli/src/commands/env/update.ts)_
@@ -1860,11 +1893,13 @@ open the PostHog dashboard for the linked PostHog project
 
 ```
 USAGE
-  $ eas integrations:posthog:dashboard [--json] [--non-interactive]
+  $ eas integrations:posthog:dashboard [--show-link] [--json] [--non-interactive]
 
 FLAGS
   --json             Enable JSON output, non-JSON messages will be printed to stderr. Implies --non-interactive.
   --non-interactive  Run the command in non-interactive mode.
+  --show-link        Print the signed-in dashboard URL in addition to opening it. The URL contains a single-use login
+                     token.
 
 DESCRIPTION
   open the PostHog dashboard for the linked PostHog project
@@ -2049,7 +2084,8 @@ USAGE
     <value>] [--project-id <value>] [--json] [--non-interactive]
 
 ARGUMENTS
-  [METRIC]  (tti|ttr|cold_launch|warm_launch|bundle_load|update_download) Metric to query (e.g. tti, cold_launch)
+  [METRIC]  (nav_cold_ttr|nav_warm_ttr|nav_tti|tti|ttr|cold_launch|warm_launch|bundle_load|update_download) Metric to
+            query (e.g. tti, cold_launch, nav_tti)
 
 FLAGS
   --after=<value>        Cursor for pagination. Use the endCursor from a previous query to fetch the next page.
@@ -2080,7 +2116,7 @@ display aggregated performance metric statistics grouped by app version
 ```
 USAGE
   $ eas observe:metrics-summary [--platform android|ios] [--metric
-    tti|ttr|cold_launch|warm_launch|bundle_load|update_download...] [--stat
+    nav_cold_ttr|nav_warm_ttr|nav_tti|tti|ttr|cold_launch|warm_launch|bundle_load|update_download...] [--stat
     min|median|max|average|p80|p90|p99|eventCount...] [--start <value> | --days <value>] [--end <value> | ]
     [--project-id <value>] [--json] [--non-interactive]
 
@@ -2089,7 +2125,8 @@ FLAGS
   --end=<value>         End of time range (ISO date)
   --json                Enable JSON output, non-JSON messages will be printed to stderr. Implies --non-interactive.
   --metric=<option>...  Metric name to display (can be specified multiple times).
-                        <options: tti|ttr|cold_launch|warm_launch|bundle_load|update_download>
+                        <options:
+                        nav_cold_ttr|nav_warm_ttr|nav_tti|tti|ttr|cold_launch|warm_launch|bundle_load|update_download>
   --non-interactive     Run the command in non-interactive mode.
   --platform=<option>   Filter by platform
                         <options: android|ios>
@@ -2110,7 +2147,7 @@ display app navigation route metrics (Cold TTR, Warm TTR, TTI) grouped by route
 
 ```
 USAGE
-  $ eas observe:routes [--platform android|ios] [--metric cold_ttr|warm_ttr|nav_tti...] [--stat
+  $ eas observe:routes [--platform android|ios] [--metric nav_cold_ttr|nav_warm_ttr|nav_tti...] [--stat
     median|med|p90|count|event_count|eventCount...] [--after <value>] [--limit <value>] [--start <value> | --days
     <value>] [--end <value> | ] [--app-version <value>] [--update-id <value>] [--build-number <value>] [--route-name
     <value>...] [--project-id <value>] [--json] [--non-interactive]
@@ -2124,7 +2161,7 @@ FLAGS
   --json                   Enable JSON output, non-JSON messages will be printed to stderr. Implies --non-interactive.
   --limit=<value>          The number of items to fetch each query. Defaults to 50 and is capped at 200.
   --metric=<option>...     Navigation metric to display (can be specified multiple times). Defaults to all three.
-                           <options: cold_ttr|warm_ttr|nav_tti>
+                           <options: nav_cold_ttr|nav_warm_ttr|nav_tti>
   --non-interactive        Run the command in non-interactive mode.
   --platform=<option>      Filter by platform
                            <options: android|ios>
diff --git a/packages/eas-cli/src/commands/env/__tests__/EnvSet.test.ts b/packages/eas-cli/src/commands/env/__tests__/EnvSet.test.ts
new file mode 100644
index 0000000000..6be508b986
--- /dev/null
+++ b/packages/eas-cli/src/commands/env/__tests__/EnvSet.test.ts
@@ -0,0 +1,477 @@
+import fs from 'fs-extra';
+
+import { getMockAppFragment, getMockOclifConfig } from '../../../__tests__/commands/utils';
+import { DefaultEnvironment } from '../../../build/utils/environment';
+import { ExpoGraphqlClient } from '../../../commandUtils/context/contextUtils/createGraphqlClient';
+import { testProjectId } from '../../../credentials/__tests__/fixtures-constants';
+import {
+  EnvironmentSecretType,
+  EnvironmentVariableScope,
+  EnvironmentVariableVisibility,
+} from '../../../graphql/generated';
+import { EnvironmentVariableMutation } from '../../../graphql/mutations/EnvironmentVariableMutation';
+import { AppQuery } from '../../../graphql/queries/AppQuery';
+import { EnvironmentVariablesQuery } from '../../../graphql/queries/EnvironmentVariablesQuery';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../../utils/json';
+import {
+  parseVisibility,
+  promptVariableEnvironmentAsync,
+  promptVariableNameAsync,
+  promptVariableTypeAsync,
+  promptVariableValueAsync,
+} from '../../../utils/prompts';
+import EnvSet from '../set';
+
+jest.mock('../../../graphql/mutations/EnvironmentVariableMutation');
+jest.mock('../../../graphql/queries/AppQuery');
+jest.mock('../../../graphql/queries/EnvironmentVariablesQuery');
+jest.mock('../../../utils/prompts');
+jest.mock('../../../utils/json');
+jest.mock('fs-extra');
+
+describe(EnvSet, () => {
+  const graphqlClient = {} as any as ExpoGraphqlClient;
+  const mockConfig = getMockOclifConfig();
+  const variableId = 'testId';
+  const testAccountId = 'test-account-id';
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+    jest
+      .mocked(parseVisibility)
+      .mockImplementation(jest.requireActual('../../../utils/prompts').parseVisibility);
+
+    jest.mocked(AppQuery.byIdAsync).mockImplementation(async () => getMockAppFragment());
+    jest
+      .mocked(EnvironmentVariableMutation.createForAppAsync)
+      .mockImplementation(async (_client, input, _appId) => ({
+        ...input,
+        id: variableId,
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+        scope: EnvironmentVariableScope.Project,
+        type: EnvironmentSecretType.String,
+      }));
+    jest
+      .mocked(EnvironmentVariableMutation.createSharedVariableAsync)
+      .mockImplementation(async (_client, input, _appId) => ({
+        ...input,
+        id: variableId,
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+        scope: EnvironmentVariableScope.Shared,
+        type: EnvironmentSecretType.String,
+      }));
+    jest
+      .mocked(EnvironmentVariableMutation.updateAsync)
+      .mockImplementation(async (_client, input) => ({
+        ...input,
+        id: variableId,
+        name: 'VarName',
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+        scope: EnvironmentVariableScope.Project,
+        type: EnvironmentSecretType.String,
+      }));
+    jest.mocked(EnvironmentVariablesQuery.byAppIdAsync).mockImplementation(async () => []);
+    jest.mocked(EnvironmentVariablesQuery.sharedAsync).mockImplementation(async () => []);
+  });
+
+  it('creates a project variable when none exists', async () => {
+    const command = new EnvSet(
+      [
+        '--name',
+        'VarName',
+        '--value',
+        'VarValue',
+        '--environment',
+        'production',
+        '--visibility',
+        'secret',
+      ],
+      mockConfig
+    );
+
+    // @ts-expect-error
+    jest.spyOn(command, 'getContextAsync').mockReturnValue({
+      loggedIn: { graphqlClient },
+      projectId: testProjectId,
+    });
+
+    await command.runAsync();
+
+    expect(EnvironmentVariableMutation.createForAppAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      {
+        name: 'VarName',
+        value: 'VarValue',
+        environments: [DefaultEnvironment.Production],
+        visibility: EnvironmentVariableVisibility.Secret,
+        type: EnvironmentSecretType.String,
+      },
+      testProjectId
+    );
+    expect(EnvironmentVariableMutation.updateAsync).not.toHaveBeenCalled();
+  });
+
+  it('updates an existing project variable in the same environment without --force', async () => {
+    const command = new EnvSet(
+      [
+        '--name',
+        'VarName',
+        '--value',
+        'VarValue',
+        '--environment',
+        'production',
+        '--visibility',
+        'secret',
+      ],
+      mockConfig
+    );
+
+    // @ts-expect-error
+    jest.spyOn(command, 'getContextAsync').mockReturnValue({
+      loggedIn: { graphqlClient },
+      projectId: testProjectId,
+    });
+
+    const otherVariableId = 'otherId';
+
+    jest
+      .mocked(EnvironmentVariablesQuery.byAppIdAsync)
+      // @ts-expect-error
+      .mockImplementation(async () => [
+        {
+          id: otherVariableId,
+          environments: [DefaultEnvironment.Production],
+          scope: EnvironmentVariableScope.Project,
+        },
+      ]);
+
+    await command.runAsync();
+
+    expect(EnvironmentVariablesQuery.byAppIdAsync).toHaveBeenCalledWith(graphqlClient, {
+      appId: testProjectId,
+      filterNames: ['VarName'],
+    });
+
+    expect(EnvironmentVariableMutation.updateAsync).toHaveBeenCalledWith(graphqlClient, {
+      id: otherVariableId,
+      name: 'VarName',
+      value: 'VarValue',
+      environments: [DefaultEnvironment.Production],
+      visibility: EnvironmentVariableVisibility.Secret,
+      type: undefined,
+      fileName: undefined,
+    });
+    expect(EnvironmentVariableMutation.createForAppAsync).not.toHaveBeenCalled();
+  });
+
+  it('creates an account-wide variable when none exists', async () => {
+    const command = new EnvSet(
+      [
+        '--name',
+        'VarName',
+        '--value',
+        'VarValue',
+        '--environment',
+        'production',
+        '--scope',
+        'account',
+      ],
+      mockConfig
+    );
+
+    // @ts-expect-error
+    jest.spyOn(command, 'getContextAsync').mockReturnValue({
+      loggedIn: { graphqlClient },
+      projectId: testProjectId,
+    });
+
+    await command.runAsync();
+
+    expect(EnvironmentVariableMutation.createSharedVariableAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      {
+        name: 'VarName',
+        value: 'VarValue',
+        environments: [DefaultEnvironment.Production],
+        visibility: EnvironmentVariableVisibility.Public,
+        type: EnvironmentSecretType.String,
+      },
+      testAccountId
+    );
+  });
+
+  it('updates an existing account-wide variable without --force', async () => {
+    const command = new EnvSet(
+      [
+        '--name',
+        'VarName',
+        '--value',
+        'VarValue',
+        '--environment',
+        'production',
+        '--scope',
+        'account',
+      ],
+      mockConfig
+    );
+
+    const otherVariableId = 'otherId';
+
+    // @ts-expect-error
+    jest.spyOn(command, 'getContextAsync').mockReturnValue({
+      loggedIn: { graphqlClient },
+      projectId: testProjectId,
+    });
+
+    jest
+      .mocked(EnvironmentVariablesQuery.sharedAsync)
+      // @ts-expect-error
+      .mockImplementation(async () => [
+        {
+          id: otherVariableId,
+          environments: [DefaultEnvironment.Production],
+          scope: EnvironmentVariableScope.Shared,
+        },
+      ]);
+
+    await command.runAsync();
+
+    expect(EnvironmentVariableMutation.updateAsync).toHaveBeenCalledWith(graphqlClient, {
+      id: otherVariableId,
+      name: 'VarName',
+      value: 'VarValue',
+      environments: [DefaultEnvironment.Production],
+      visibility: EnvironmentVariableVisibility.Public,
+      type: undefined,
+    });
+    expect(EnvironmentVariableMutation.createSharedVariableAsync).not.toHaveBeenCalled();
+  });
+
+  it('accepts the environment as a positional argument', async () => {
+    const command = new EnvSet(
+      [
+        'development',
+        '--name',
+        'TEST_VAR',
+        '--value',
+        'test-value',
+        '--visibility',
+        'plaintext',
+        '--scope',
+        'project',
+        '--non-interactive',
+      ],
+      mockConfig
+    );
+
+    // @ts-expect-error
+    jest.spyOn(command, 'getContextAsync').mockReturnValue({
+      loggedIn: { graphqlClient },
+      projectId: testProjectId,
+    });
+
+    await command.runAsync();
+
+    expect(EnvironmentVariableMutation.createForAppAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      {
+        name: 'TEST_VAR',
+        value: 'test-value',
+        environments: [DefaultEnvironment.Development],
+        visibility: EnvironmentVariableVisibility.Public,
+        type: EnvironmentSecretType.String,
+      },
+      testProjectId
+    );
+  });
+
+  it('prompts for missing arguments', async () => {
+    const command = new EnvSet([], mockConfig);
+
+    jest.mocked(promptVariableNameAsync).mockImplementation(async () => 'VarName');
+    jest.mocked(promptVariableValueAsync).mockImplementation(async () => 'VarValue');
+    jest
+      .mocked(promptVariableTypeAsync)
+      .mockImplementation(async () => EnvironmentSecretType.String);
+
+    jest
+      .mocked(promptVariableEnvironmentAsync)
+      // @ts-expect-error
+      .mockImplementation(async () => [DefaultEnvironment.Production]);
+
+    // @ts-expect-error
+    jest.spyOn(command, 'getContextAsync').mockReturnValue({
+      loggedIn: { graphqlClient },
+      projectId: testProjectId,
+    });
+
+    await command.runAsync();
+
+    expect(promptVariableNameAsync).toHaveBeenCalled();
+    expect(promptVariableValueAsync).toHaveBeenCalled();
+    expect(promptVariableEnvironmentAsync).toHaveBeenCalled();
+    expect(EnvironmentVariableMutation.createForAppAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      {
+        name: 'VarName',
+        value: 'VarValue',
+        environments: [DefaultEnvironment.Production],
+        visibility: EnvironmentVariableVisibility.Public,
+        type: EnvironmentSecretType.String,
+      },
+      testProjectId
+    );
+  });
+
+  it('preserves the file type when updating a file variable with --value but no --type', async () => {
+    const testFilePath = '/path/to/creds.json';
+    const testFileBase64 = 'dGVzdCBmaWxlIGNvbnRlbnQ=';
+    const testFileName = 'creds.json';
+    const otherVariableId = 'otherId';
+
+    jest
+      .mocked(EnvironmentVariablesQuery.byAppIdAsync)
+      // @ts-expect-error
+      .mockImplementation(async () => [
+        {
+          id: otherVariableId,
+          name: 'VarName',
+          environments: [DefaultEnvironment.Production],
+          scope: EnvironmentVariableScope.Project,
+          type: EnvironmentSecretType.FileBase64,
+        },
+      ]);
+
+    jest.mocked(fs.pathExists).mockImplementation(() => Promise.resolve(true));
+    jest.mocked(fs.readFile).mockImplementation(() => Promise.resolve(testFileBase64));
+
+    const command = new EnvSet(
+      [
+        '--name',
+        'VarName',
+        '--value',
+        testFilePath,
+        '--environment',
+        'production',
+        '--visibility',
+        'secret',
+        '--non-interactive',
+      ],
+      mockConfig
+    );
+
+    // @ts-expect-error
+    jest.spyOn(command, 'getContextAsync').mockReturnValue({
+      loggedIn: { graphqlClient },
+      projectId: testProjectId,
+    });
+
+    await command.runAsync();
+
+    expect(fs.pathExists).toHaveBeenCalledWith(testFilePath);
+    expect(fs.readFile).toHaveBeenCalledWith(testFilePath, 'base64');
+    expect(EnvironmentVariableMutation.updateAsync).toHaveBeenCalledWith(graphqlClient, {
+      id: otherVariableId,
+      name: 'VarName',
+      value: testFileBase64,
+      visibility: EnvironmentVariableVisibility.Secret,
+      environments: [DefaultEnvironment.Production],
+      type: EnvironmentSecretType.FileBase64,
+      fileName: testFileName,
+    });
+  });
+
+  it('throws when updating a file variable with a value that is not a valid file path and no --type', async () => {
+    const plainStringValue = 'some-new-value';
+    const otherVariableId = 'otherId';
+
+    jest
+      .mocked(EnvironmentVariablesQuery.byAppIdAsync)
+      // @ts-expect-error
+      .mockImplementation(async () => [
+        {
+          id: otherVariableId,
+          name: 'VarName',
+          environments: [DefaultEnvironment.Production],
+          scope: EnvironmentVariableScope.Project,
+          type: EnvironmentSecretType.FileBase64,
+        },
+      ]);
+
+    jest.mocked(fs.pathExists).mockImplementation(() => Promise.resolve(false));
+
+    const command = new EnvSet(
+      [
+        '--name',
+        'VarName',
+        '--value',
+        plainStringValue,
+        '--environment',
+        'production',
+        '--visibility',
+        'secret',
+        '--non-interactive',
+      ],
+      mockConfig
+    );
+
+    // @ts-expect-error
+    jest.spyOn(command, 'getContextAsync').mockReturnValue({
+      loggedIn: { graphqlClient },
+      projectId: testProjectId,
+    });
+
+    await expect(command.runAsync()).rejects.toThrow(
+      `Variable "VarName" is a file type, but "${plainStringValue}" does not exist as a file. If you want to convert it to a string, pass --type string.`
+    );
+    expect(EnvironmentVariableMutation.updateAsync).not.toHaveBeenCalled();
+  });
+
+  it('outputs the created variable as JSON with --json and does not print a tick', async () => {
+    const command = new EnvSet(
+      [
+        '--name',
+        'VarName',
+        '--value',
+        'VarValue',
+        '--environment',
+        'production',
+        '--visibility',
+        'plaintext',
+        '--json',
+      ],
+      mockConfig
+    );
+
+    // @ts-expect-error
+    jest.spyOn(command, 'getContextAsync').mockReturnValue({
+      loggedIn: { graphqlClient },
+      projectId: testProjectId,
+    });
+
+    await command.runAsync();
+
+    expect(enableJsonOutput).toHaveBeenCalled();
+    expect(EnvironmentVariableMutation.createForAppAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      {
+        name: 'VarName',
+        value: 'VarValue',
+        environments: [DefaultEnvironment.Production],
+        visibility: EnvironmentVariableVisibility.Public,
+        type: EnvironmentSecretType.String,
+      },
+      testProjectId
+    );
+    expect(printJsonOnlyOutput).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: variableId,
+        name: 'VarName',
+        value: 'VarValue',
+      })
+    );
+  });
+});
diff --git a/packages/eas-cli/src/commands/env/create.ts b/packages/eas-cli/src/commands/env/create.ts
index 9c5af17a8a..f6e4910511 100644
--- a/packages/eas-cli/src/commands/env/create.ts
+++ b/packages/eas-cli/src/commands/env/create.ts
@@ -57,7 +57,8 @@ interface CreateFlags {
 }
 
 export default class EnvCreate extends EasCommand {
-  static override description = 'create an environment variable for the current project or account';
+  static override description =
+    'create an environment variable for the current project or account (deprecated, use eas env:set)';
 
   static override args = {
     environment: Args.string({
@@ -95,6 +96,9 @@ export default class EnvCreate extends EasCommand {
   };
 
   async runAsync(): Promise<void> {
+    Log.warn('This command is deprecated. Use eas env:set instead.');
+    Log.newLine();
+
     const { args, flags } = await this.parse(EnvCreate);
 
     const validatedFlags = this.sanitizeFlags(flags);
diff --git a/packages/eas-cli/src/commands/env/set.ts b/packages/eas-cli/src/commands/env/set.ts
new file mode 100644
index 0000000000..56dcb91553
--- /dev/null
+++ b/packages/eas-cli/src/commands/env/set.ts
@@ -0,0 +1,384 @@
+import { Args, Flags } from '@oclif/core';
+import chalk from 'chalk';
+import fs from 'fs-extra';
+import path from 'path';
+
+import EasCommand from '../../commandUtils/EasCommand';
+import { ExpoGraphqlClient } from '../../commandUtils/context/contextUtils/createGraphqlClient';
+import {
+  EASEnvironmentVariableScopeFlag,
+  EASEnvironmentVariableScopeFlagValue,
+  EASMultiEnvironmentFlag,
+  EASVariableVisibilityFlag,
+  EasNonInteractiveAndJsonFlags,
+  resolveNonInteractiveAndJsonFlags,
+} from '../../commandUtils/flags';
+import {
+  EnvironmentSecretType,
+  EnvironmentVariableFragment,
+  EnvironmentVariableScope,
+  EnvironmentVariableVisibility,
+} from '../../graphql/generated';
+import { EnvironmentVariableMutation } from '../../graphql/mutations/EnvironmentVariableMutation';
+import { EnvironmentVariablesQuery } from '../../graphql/queries/EnvironmentVariablesQuery';
+import Log from '../../log';
+import {
+  getDisplayNameForProjectIdAsync,
+  getOwnerAccountForProjectIdAsync,
+} from '../../project/projectUtils';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
+import {
+  parseVisibility,
+  promptVariableEnvironmentAsync,
+  promptVariableNameAsync,
+  promptVariableTypeAsync,
+  promptVariableValueAsync,
+  promptVariableVisibilityAsync,
+} from '../../utils/prompts';
+
+interface RawSetFlags {
+  name?: string;
+  value?: string;
+  type?: 'string' | 'file';
+  visibility?: 'plaintext' | 'sensitive' | 'secret';
+  scope: EASEnvironmentVariableScopeFlagValue;
+  environment?: string[];
+  'non-interactive': boolean;
+  json: boolean;
+}
+
+interface SetFlags {
+  name?: string;
+  value?: string;
+  type?: 'string' | 'file';
+  visibility?: 'plaintext' | 'sensitive' | 'secret';
+  scope: EnvironmentVariableScope;
+  environment?: string[];
+  'non-interactive': boolean;
+  json: boolean;
+}
+
+interface ResolvedVariableDetails {
+  value: string;
+  visibility: EnvironmentVariableVisibility;
+  type: EnvironmentSecretType | undefined;
+  fileName: string | undefined;
+}
+
+export default class EnvSet extends EasCommand {
+  static override description =
+    'set (create or update) an environment variable on the current project or account';
+
+  static override args = {
+    environment: Args.string({
+      description:
+        "Environment to set the variable in. Default environments are 'production', 'preview', and 'development'.",
+      required: false,
+    }),
+  };
+
+  static override flags = {
+    name: Flags.string({
+      description: 'Name of the variable',
+    }),
+    value: Flags.string({
+      description: 'Text value of the variable',
+    }),
+    type: Flags.option({
+      description: 'The type of variable',
+      options: ['string', 'file'] as const,
+    })(),
+    ...EASVariableVisibilityFlag,
+    ...EASEnvironmentVariableScopeFlag,
+    ...EASMultiEnvironmentFlag,
+    ...EasNonInteractiveAndJsonFlags,
+  };
+
+  static override contextDefinition = {
+    ...this.ContextOptions.ProjectId,
+    ...this.ContextOptions.Analytics,
+    ...this.ContextOptions.LoggedIn,
+  };
+
+  async runAsync(): Promise<void> {
+    const { args, flags } = await this.parse(EnvSet);
+
+    const {
+      name: nameFlag,
+      value,
+      type,
+      visibility,
+      scope,
+      environment,
+    } = this.sanitizeFlags(flags);
+    const { json: jsonFlag, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
+
+    const {
+      projectId,
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(EnvSet, {
+      nonInteractive,
+    });
+
+    if (jsonFlag) {
+      enableJsonOutput();
+    }
+
+    const name = nameFlag ?? (await promptVariableNameAsync(nonInteractive));
+
+    const environments = await this.resolveEnvironmentsAsync(environment, args.environment, {
+      nonInteractive,
+      graphqlClient,
+      projectId,
+    });
+
+    const existingVariable = await this.findExistingVariableAsync(graphqlClient, {
+      scope,
+      projectId,
+      name,
+      environments,
+    });
+
+    const {
+      value: resolvedValue,
+      visibility: resolvedVisibility,
+      type: resolvedType,
+      fileName,
+    } = await this.resolveVariableDetailsAsync(
+      { name, value, type, visibility, nonInteractive },
+      existingVariable
+    );
+
+    const [projectDisplayName, ownerAccount] = await Promise.all([
+      getDisplayNameForProjectIdAsync(graphqlClient, projectId),
+      getOwnerAccountForProjectIdAsync(graphqlClient, projectId),
+    ]);
+
+    if (scope === EnvironmentVariableScope.Project) {
+      const variable = existingVariable
+        ? await EnvironmentVariableMutation.updateAsync(graphqlClient, {
+            id: existingVariable.id,
+            name,
+            value: resolvedValue,
+            visibility: resolvedVisibility,
+            environments,
+            type: resolvedType,
+            fileName,
+          })
+        : await EnvironmentVariableMutation.createForAppAsync(
+            graphqlClient,
+            {
+              name,
+              value: resolvedValue,
+              environments,
+              visibility: resolvedVisibility,
+              type: resolvedType ?? EnvironmentSecretType.String,
+              fileName,
+            },
+            projectId
+          );
+
+      if (!variable) {
+        throw new Error(
+          `Could not set variable with name ${name} on project ${projectDisplayName}`
+        );
+      }
+
+      if (jsonFlag) {
+        printJsonOnlyOutput(variable);
+      } else {
+        Log.withTick(
+          `${existingVariable ? 'Updated' : 'Created'} variable ${chalk.bold(name)} on project ${chalk.bold(
+            projectDisplayName
+          )}.`
+        );
+      }
+    } else if (scope === EnvironmentVariableScope.Shared) {
+      const variable = existingVariable
+        ? await EnvironmentVariableMutation.updateAsync(graphqlClient, {
+            id: existingVariable.id,
+            name,
+            value: resolvedValue,
+            visibility: resolvedVisibility,
+            environments,
+            type: resolvedType,
+          })
+        : await EnvironmentVariableMutation.createSharedVariableAsync(
+            graphqlClient,
+            {
+              name,
+              value: resolvedValue,
+              visibility: resolvedVisibility,
+              environments,
+              type: resolvedType ?? EnvironmentSecretType.String,
+            },
+            ownerAccount.id
+          );
+
+      if (!variable) {
+        throw new Error(`Could not set variable with name ${name} on account ${ownerAccount.name}`);
+      }
+
+      if (jsonFlag) {
+        printJsonOnlyOutput(variable);
+      } else {
+        Log.withTick(
+          `${existingVariable ? 'Updated' : 'Created'} variable ${chalk.bold(name)} on account ${chalk.bold(
+            ownerAccount.name
+          )}.`
+        );
+      }
+    }
+  }
+
+  private async resolveEnvironmentsAsync(
+    environmentFlag: string[] | undefined,
+    environmentArg: string | undefined,
+    {
+      nonInteractive,
+      graphqlClient,
+      projectId,
+    }: { nonInteractive: boolean; graphqlClient: ExpoGraphqlClient; projectId: string }
+  ): Promise<string[]> {
+    const environments = environmentFlag ?? (environmentArg ? [environmentArg] : undefined);
+    if (environments && environments.length > 0) {
+      return environments;
+    }
+
+    const promptedEnvironments = await promptVariableEnvironmentAsync({
+      nonInteractive,
+      multiple: true,
+      canEnterCustomEnvironment: true,
+      graphqlClient,
+      projectId,
+    });
+
+    if (!promptedEnvironments || promptedEnvironments.length === 0) {
+      throw new Error('No environments selected');
+    }
+
+    return promptedEnvironments;
+  }
+
+  private async findExistingVariableAsync(
+    graphqlClient: ExpoGraphqlClient,
+    {
+      scope,
+      projectId,
+      name,
+      environments,
+    }: {
+      scope: EnvironmentVariableScope;
+      projectId: string;
+      name: string;
+      environments: string[];
+    }
+  ): Promise<EnvironmentVariableFragment | undefined> {
+    if (scope === EnvironmentVariableScope.Project) {
+      const existingVariables = await EnvironmentVariablesQuery.byAppIdAsync(graphqlClient, {
+        appId: projectId,
+        filterNames: [name],
+      });
+
+      return existingVariables.find(
+        variable =>
+          variable.scope === EnvironmentVariableScope.Project &&
+          variable.environments?.some(env => environments.includes(env))
+      );
+    }
+
+    const existingVariables = await EnvironmentVariablesQuery.sharedAsync(graphqlClient, {
+      appId: projectId,
+      filterNames: [name],
+    });
+
+    return existingVariables.find(variable =>
+      variable.environments?.some(env => environments.includes(env))
+    );
+  }
+
+  private async resolveVariableDetailsAsync(
+    {
+      name,
+      value,
+      type,
+      visibility,
+      nonInteractive,
+    }: {
+      name: string;
+      value?: string;
+      type?: 'string' | 'file';
+      visibility?: 'plaintext' | 'sensitive' | 'secret';
+      nonInteractive: boolean;
+    },
+    existingVariable: EnvironmentVariableFragment | undefined
+  ): Promise<ResolvedVariableDetails> {
+    let newType: EnvironmentSecretType | undefined;
+    if (type === 'file') {
+      newType = EnvironmentSecretType.FileBase64;
+    } else if (type === 'string') {
+      newType = EnvironmentSecretType.String;
+    }
+
+    let newVisibility = visibility ? parseVisibility(visibility) : undefined;
+
+    if (!type && !value && !nonInteractive) {
+      newType = await promptVariableTypeAsync(nonInteractive, existingVariable?.type);
+    }
+
+    if (!newVisibility) {
+      newVisibility = await promptVariableVisibilityAsync(
+        nonInteractive,
+        existingVariable?.visibility
+      );
+    }
+
+    // When a value is provided without an explicit --type, keep the existing variable's type so
+    // that updating a file variable does not silently convert it to a plain string.
+    if (value && !newType) {
+      newType = existingVariable?.type;
+    }
+
+    if (!value) {
+      value = await promptVariableValueAsync({
+        nonInteractive,
+        hidden: newVisibility !== EnvironmentVariableVisibility.Public,
+        filePath: (newType ?? existingVariable?.type) === EnvironmentSecretType.FileBase64,
+      });
+    }
+
+    newVisibility = newVisibility ?? EnvironmentVariableVisibility.Public;
+
+    let fileName: string | undefined;
+    if (newType === EnvironmentSecretType.FileBase64) {
+      const environmentFilePath = path.resolve(value);
+      if (!(await fs.pathExists(environmentFilePath))) {
+        if (type === 'file') {
+          throw new Error(`File "${value}" does not exist`);
+        }
+        throw new Error(
+          `Variable "${name}" is a file type, but "${value}" does not exist as a file. If you want to convert it to a string, pass --type string.`
+        );
+      }
+      fileName = path.basename(environmentFilePath);
+      value = await fs.readFile(environmentFilePath, 'base64');
+    }
+
+    return {
+      value,
+      visibility: newVisibility,
+      type: newType,
+      fileName,
+    };
+  }
+
+  private sanitizeFlags(flags: RawSetFlags): SetFlags {
+    return {
+      ...flags,
+      scope:
+        flags.scope === 'account'
+          ? EnvironmentVariableScope.Shared
+          : EnvironmentVariableScope.Project,
+    };
+  }
+}
diff --git a/packages/eas-cli/src/commands/env/update.ts b/packages/eas-cli/src/commands/env/update.ts
index 67d22729d4..d61ebf66d9 100644
--- a/packages/eas-cli/src/commands/env/update.ts
+++ b/packages/eas-cli/src/commands/env/update.ts
@@ -63,7 +63,8 @@ interface UpdateFlags {
 }
 
 export default class EnvUpdate extends EasCommand {
-  static override description = 'update an environment variable on the current project or account';
+  static override description =
+    'update an environment variable on the current project or account (deprecated, use eas env:set)';
 
   static override flags = {
     'variable-name': Flags.string({
@@ -104,6 +105,9 @@ export default class EnvUpdate extends EasCommand {
   };
 
   async runAsync(): Promise<void> {
+    Log.warn('This command is deprecated. Use eas env:set instead.');
+    Log.newLine();
+
     const { args, flags } = await this.parse(EnvUpdate);
     const {
       name,