Go Environment Variables: Secrets Manager for Go Apps
Manage encrypted secrets for Go services with Capy. Wrap go run and go test, keep os.Getenv working unchanged, and ship binaries with zero plaintext.
Use capy run to decrypt .env and pass the plaintext values to your binary. Your code reads env vars with os.Getenv or any config library (Viper, envconfig).
1
Install the CLI
brew install capysc/tap/capy
npm install -g @capysc/cli
bun add -g @capysc/cli
2
Sync your secrets
capy
Authenticates, creates the project on first run, encrypts every value in .env, and rewrites the file with capy:… snippets.
3
Run your app
capy run -- go run .capy run -- ./my-binarycapy run -- go test ./...
