Skip to main content
The capy run command decrypts your .env in memory and hands the plaintext to your Python process. Your code reads env vars the normal way: os.environ or os.getenv. There is no library to import.
1

Install the CLI

2

Sync your secrets

From a project that has a .env:
Capy authenticates you, creates a project on first run, encrypts every value in .env, and gitignores the file. Only keep.lock (a small versioning manifest) gets committed.
3

Run your app with capy run

Prefix whatever command you normally run:
Capy reads .env, decrypts values, and passes them as environment variables to the child process. Your code reads them the usual way:
Drop load_dotenv(). After the first sync, .env holds capy:… ciphertext, so python-dotenv would read encrypted strings - and load_dotenv(override=True) would overwrite the plaintext values capy run just put in os.environ.
4

Invite a teammate

Capy prints a one-line redeem code. Send it out-of-band (Signal, password manager). They run capy redeem <code> to join.
5

Deploy

Capy walks you through hooking up the deploy platform of your choice - Vercel, Fly.io, Railway, Render, Kubernetes, and more.

​
What’s next

Running your app

The full story on capy run - signals, exit codes, env precedence.

Deploying

How deploy tokens work and what your platform needs.
Last modified on August 11, 2026