Synopsis
Description
Encrypts every plaintext value in the .env of the current directory and uploads the result for the branch you’re on. Values that are already capy:… snippets pass through unchanged. Use it when you want to publish a change immediately and don’t need to reconcile against remote edits (for instance, you just ran capy and know local is current).
push doesn’t fetch the remote’s values or merge with them - it uploads your local state and repins those variables in keep.lock for the active branch. If you might be behind, run capy status or capy before pushing.
capy push takes no options. It needs a keep.lock in the current directory - run capy first to initialize the project - and it stops with No .env file to push when .env is missing or has no variables.
After the push, Capy commits the updated keep.lock for you (chore(capy): pin <branch> secrets) unless you set CAPY_NO_AUTOCOMMIT=1. Your teammates’ pins don’t move until that commit is in git.
Example
Local-only mode
In local-only mode there’s no server to push to, so capy push is a local commit. Capy unlocks your local key (prompting for the passphrase when the session has expired), encrypts .env, and updates keep.lock without contacting a service:
See also
capy - the full pull-and-push sync loopcapy status - check for drift before pushing
Last modified on August 11, 2026
