Rust Secrets Management: Encrypted Env for Cargo

Use capy run to decrypt .env and pass the plaintext values to your binary. Your code reads env vars with std::env::var or crates like envy.

Install the CLI

brew install capysc/tap/capy

npm install -g @capysc/cli

bun add -g @capysc/cli

Sync your secrets

capy

Run your app

capy run -- cargo run
capy run -- ./target/release/my-binary
capy run -- cargo test

Read env vars the standard way:

use std::env;

let db_url = env::var("DATABASE_URL").expect("DATABASE_URL not set");

Invite a teammate

capy invite teammate@example.com

Deploy

capy deploy

What’s next

The full story on capy run.

Last modified on June 10, 2026