Railway, Render & Heroku: Secrets via capy run

​

The pattern

// package.json
{
  "scripts": {
    "start": "capy run -- node server.js"
  }
}

• Python: capy run -- python app.py
• Go: capy run -- ./my-binary
• Ruby: capy run -- bundle exec rails server

​

Railway

1. Install: add @capysc/cli as a dep (bun add @capysc/cli). Railway will install it during the build step.
2. Start command: either use the start script in package.json (Railway runs npm start by default) or set a custom start command in Railway’s service settings: capy run -- <your cmd>.
3. Env vars: set SECRETS_BLOB and PROJECT_KEY in Variables (Railway dashboard).
4. Deploy: push to the connected git branch.

​

Render

1. Install: @capysc/cli as a dep.
2. Start command: in Render’s service settings → Start Command, set capy run -- <your cmd>.
3. Env vars: Environment tab → add SECRETS_BLOB and PROJECT_KEY.
4. Deploy: push, Render picks up the new build.

​

Heroku

# Procfile
web: capy run -- node server.js

heroku config:set \
  SECRETS_BLOB="..." \
  PROJECT_KEY="..."

git push heroku main

​

Per-environment secrets

• Railway: create a new Capy deploy token for each Railway environment (Production, Staging, etc.)
• Render: same - each service instance gets its own token
• Heroku: each Heroku pipeline stage gets its own config vars

​

Revocation