Go Environment Variables: Secrets Manager for Go Apps

Use capy run to decrypt .env and pass the plaintext values to your binary. Your code reads env vars with os.Getenv or any config library (Viper, envconfig).

Install the CLI

brew install capysc/tap/capy

npm install -g @capysc/cli

bun add -g @capysc/cli

Sync your secrets

capy

Authenticates, creates the project on first run, encrypts every value in .env, and rewrites the file with capy:… snippets.

Run your app

capy run -- go run .
capy run -- ./my-binary
capy run -- go test ./...

Read env vars the standard way:

import "os"

dbURL := os.Getenv("DATABASE_URL")

Invite a teammate

capy invite teammate@example.com

Deploy

capy deploy

What’s next

Running your app

The full story on capy run.

Deploying

Deploy tokens and platform walkthroughs.

Last modified on June 10, 2026

Python Ruby

Getting started

Using Capy

Deploying

Organizations

Branches

Team

CLI reference

Under the hood

Comparisons

Go Environment Variables: Secrets Manager for Go Apps

What’s next

Running your app

Deploying

​What’s next

Running your app

Deploying

What’s next