Manage Node.js Environment Variables Securely (Capy)

By the end of this page your .env is end-to-end encrypted, shared with your team, and ready to deploy from a Node.js app. Five commands.

Install the CLI

brew install capysc/tap/capy

npm install -g @capysc/cli

bun add -g @capysc/cli

Capy is a single CLI - no daemon, no background service.

Sync your secrets

From any project that has a .env:

capy

On the first run, Capy authenticates you in the browser, creates a project, encrypts every value in your .env, and uploads the ciphertext. Capy rewrites .env in place with capy:… snippets, gitignores it, and commits only keep.lock - a small versioning manifest that lets teammates find the right project.Run capy again whenever you want to pull or push changes.

Invite a teammate

capy invite teammate@example.com

Capy prints a one-line redeem code. Send it out-of-band. They run capy redeem <code> and now share access - no key material ever touches Capy’s backend in plaintext.

Run your app

Wrap your command with capy run:

capy run -- node server.js
capy run -- next dev
capy run -- bun test

Capy decrypts .env in memory and spawns your process with plaintext values available as process.env. Your code reads env vars the standard way - no library to import:

const db = process.env.DATABASE_URL;

Add it to your package.json scripts and forget it:

"scripts": {
  "dev": "capy run -- next dev",
  "start": "capy run -- node server.js"
}

Deploy

capy deploy

Capy asks where this project deploys. For Vercel, Cloudflare Workers, Cloudflare Pages, and AWS ECS it offers a connector that pushes the values into that platform’s secret store. For GitHub Actions it pushes SECRETS_BLOB and PROJECT_KEY into the repo’s Actions secrets so your workflow can wrap its deploy step in capy run. For every other platform it opens a local setup page in your browser with the exact env vars - SECRETS_BLOB and PROJECT_KEY - to paste into that platform’s secret store.On the token + docs path, keep capy run as your production start command—when SECRETS_BLOB and PROJECT_KEY are both set, capy run ignores .env and decrypts the blob instead. The Vercel, Cloudflare, and AWS connectors write the values into the platform’s own store, so those deployments read them from the platform and need no capy run. The deploy token is double-wrapped: half lives with your platform, half lives with the Capy service, and your app combines the two at boot time to derive the decryption key in memory.

That’s the whole loop. Edit a secret locally, run capy, redeploy. Anyone you’ve invited stays in sync. Anyone you’ve kicked loses access immediately, with no re-encryption needed.

Getting started

Using Capy

Deploying

Organizations

Branches

Team

CLI reference

Under the hood

Comparisons

Manage Node.js Environment Variables Securely (Capy)

What’s next

How it works

CLI Reference

​What’s next

How it works

CLI Reference

What’s next