Skip to main content
The capy run command decrypts your .env in memory and hands the plaintext to your Python process. Your code reads env vars the normal way: os.environ or os.getenv. There is no library to import.
1

Install the CLI

2

Sync your secrets

From a project that has a .env:
Capy authenticates you, creates or selects a project, encrypts every value in .env, and creates keep.lock. Commit that manifest; do not commit plaintext .env values.
3

Run your app with capy run

Prefix whatever command you normally run:
Capy reads .env, decrypts values, and passes them as environment variables to the child process. Your code reads them the usual way:
Drop load_dotenv(). After the first sync, .env holds capy:… ciphertext, so python-dotenv would read encrypted strings - and load_dotenv(override=True) would overwrite the plaintext values capy run just put in os.environ.
4

Invite a teammate

Capy prints a one-line redeem code. Send it out-of-band (Signal, password manager). They run capy redeem <code> to join.
5

Deploy

Capy supports deploy targets for Cloudflare Workers, Cloudflare Pages, Vercel, AWS SSM, and Dokploy. For another platform, use its secret store with the runtime-pair instructions in Deploying.

​
What’s next

Running your app

The full story on capy run - signals, exit codes, env precedence.

Deploying

How deploy tokens work and what your platform needs.
Last modified on October 2, 2026