Ruby & Rails Secrets Management with Capy

Use capy run to decrypt .env and pass the plaintext values to your Ruby process as environment variables. Your code reads them the normal way with ENV["KEY"], with no gem to add. Once Capy syncs, .env holds capy:… ciphertext rather than plaintext, so capy run is what supplies the real values.

Install the CLI

brew install capysc/tap/capy

npm install -g @capysc/cli

bun add -g @capysc/cli

Sync your secrets

capy

Run your app

capy run -- ruby app.rb
capy run -- bundle exec rails server
capy run -- bundle exec rspec

Read env vars the standard way:

db_url = ENV["DATABASE_URL"]

Invite a teammate

capy invite teammate@example.com

Deploy

capy deploy

What’s next

Running your app

The full story on capy run.

Last modified on August 11, 2026

Getting started

Using Capy

Deploying

Organizations

Branches

Team

CLI reference

Under the hood

Comparisons

Ruby & Rails Secrets Management with Capy

What’s next

Running your app

​What’s next

Running your app

What’s next