key.enc can no longer be used for service-assisted decryption because its outer wrap needs the service.
No key rotation or re-encryption is needed for remaining members to block future service-assisted decryption. This cannot recall plaintext or usable keys the former member already copied.
Removing access from the members table
capy users opens the interactive members table, but it has no org-level remove. Pressing r on a member’s row turns the Role cell into an in-place picker, and the choices are admin, project-admin, and member - capped by your own role:
Enter and press r on one of their project rows, and the choices are project-admin, member, and none. Picking none revokes their access to that one project; they stay in the org and keep their other projects.
Taking someone out of the organization is capy kick only.
Why it’s safe to skip re-encryption
The kicked user’skey.enc is an outer-wrapped blob. To use it they need to present it to the service and have the service strip the outer wrap. The service checks membership on that call - if they’ve been kicked, the call returns 403.
The bytes stay on disk until their CLI next talks to the service. When the service answers with an explicit revoked response - on their next capy or capy redeem - the CLI deletes the key material for that org: ~/.capy/orgs/{orgId}/users/{userId}/, the cached project keys under ~/.capy/orgs/{orgId}/projects/, and the keep.lock in the working directory. Until then, the outer-wrapped blob cannot produce new plaintext without the service.
See Cryptography → Revocation for the full construction.
What kicking does not do
- It doesn’t recall plaintext values they already saw. If the kicked user read a value and stored it somewhere outside Capy (a text file, a screenshot, a chat log), that copy is outside Capy’s control. Rotate anything sensitive through your normal secret-rotation process.
- It doesn’t invalidate deploy tokens. Any deploy tokens minted while they were a member still work. If you have reason to suspect they captured one, list the project’s tokens with
capy deploy listand revoke it withcapy deploy revoke <deployId>. - It doesn’t rotate the master key. Remaining members keep using the same
M. Follow your organization’s recovery procedure if a compromise is suspected.
When you do need to rotate
If you suspect the kicked user captured the seed phrase, rotate: new seed, newM, re-encrypt every secret, re-invite every remaining member.
Routine membership removal does not trigger a rekey.
What’s next
capy kick
Full command reference.
Revocation (cryptography)
The exact cryptographic enforcement.