> ## Documentation Index
> Fetch the complete documentation index at: https://capy.sc/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Python Secrets Management: Encrypted .env Files

> Replace python-dotenv with Capy: end-to-end encrypted .env files, branch-aware secrets, and one wrapper command (capy run) for uvicorn, pytest, or scripts.

The `capy run` command decrypts your `.env` in memory and hands the plaintext to your Python process. Your code reads env vars the normal way: `os.environ`, `os.getenv`, or libraries like `python-dotenv`.

<Steps>
  <Step title="Install the CLI">
    <CodeGroup>
      ```bash brew theme={null}
      brew install capysc/tap/capy
      ```

      ```bash npm theme={null}
      npm install -g @capysc/cli
      ```

      ```bash bun theme={null}
      bun add -g @capysc/cli
      ```
    </CodeGroup>
  </Step>

  <Step title="Sync your secrets">
    From a project that has a `.env`:

    ```bash theme={null}
    capy
    ```

    Capy authenticates you, creates a project on first run, encrypts every value in `.env`, and gitignores the file. Only `keep.lock` (a small versioning manifest) gets committed.
  </Step>

  <Step title="Run your app with capy run">
    Prefix whatever command you normally run:

    ```bash theme={null}
    capy run -- python app.py
    capy run -- python -m uvicorn main:app
    capy run -- pytest
    ```

    Capy reads `.env`, decrypts values, and passes them as environment variables to the child process. Your code reads them the usual way:

    ```python theme={null}
    import os

    db_url = os.environ["DATABASE_URL"]
    ```
  </Step>

  <Step title="Invite a teammate">
    ```bash theme={null}
    capy invite teammate@example.com
    ```

    Capy prints a one-line redeem code. Send it out-of-band (Signal, password manager). They run `capy redeem <code>` to join.
  </Step>

  <Step title="Deploy">
    ```bash theme={null}
    capy deploy
    ```

    Capy walks you through hooking up the deploy platform of your choice - Vercel, Fly.io, Railway, Render, Kubernetes, and more.
  </Step>
</Steps>

## What's next

<Columns cols={2}>
  <Card title="Running your app" icon="play" href="/using/running-your-app" horizontal>
    The full story on `capy run` - signals, exit codes, env precedence.
  </Card>

  <Card title="Deploying" icon="rocket" href="/using/deploying" horizontal>
    How deploy tokens work and what your platform needs.
  </Card>
</Columns>