Synopsis
Description
Reports the state of your secrets without modifying anything. status compares three sources for every variable - pinned (the hashes stored in keep.lock), local (what’s in your .env right now, decrypted), and remote (what’s on the service for this branch) - and prints every variable whose three versions don’t all agree.
Purely read-only. Safe to run on a PR branch, in CI, or anywhere else you just want to know what capy would do.
See Syncing → Conflicts for the full list of states.
Output
$ capy status
capy: my-app (development)
x Local has changes (2 differences)
x Remote has changes (1 difference)
~ DATABASE_URL (changed locally)
+ STRIPE_WEBHOOK_KEY (new locally)
- LEGACY_TOKEN (missing from remote)
Run capy to sync these changes.
Symbols
| Symbol | Meaning |
|---|
+ | Variable is new (present on one side, not pinned) |
- | Variable is missing on one side |
~ | Value differs between sides |
? | Couldn’t reach remote (access denied, network error, or no data) |
| Line | When |
|---|
> N secrets match pinned branch. | All local values match keep.lock |
x Local has changes (…) | Your .env has diverged from pinned |
x Remote has changes (…) | The service’s copy has diverged from pinned |
x Out of sync (…) | Both sides differ and remote couldn’t be reached for detail |
> Remote is up to date. | Remote matches pinned |
! Remote is empty. | First push hasn’t happened yet - run capy push |
! Could not reach remote: … | Access denied, network error, etc. |
When remote is unreachable
If status can’t reach the service (auth failure, network error, or no access to this branch), it falls back to a two-way comparison between pinned and local, and marks every variable with ?:
capy: my-app (development)
x Out of sync (3 differences)
! Could not reach remote: you do not have access
? DATABASE_URL (access denied)
? REDIS_URL (access denied)
? STRIPE_KEY (access denied)
If you have already been invited, run capy redeem [invite-code] to access these secrets.
Last modified on May 20, 2026
