Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.capy.sc/llms.txt

Use this file to discover all available pages before exploring further.

Capy has four org-level roles. The first three are chosen at invite time; Owner is implicit - the person who created the org.
RoleWhat they can do
OwnerEverything. Creator of the org. Holds the seed phrase. Cannot be kicked.
AdminInvite, kick, manage any project, create projects, manage billing.
Project AdminManage projects they own: create branches, invite to specific projects, but not manage the whole org.
MemberRead and write secrets in org-wide branches they have access to.

​
Choosing a role at invite time

capy invite alice@example.com
Capy prompts: 
? What role should alice@example.com have?
  ❯ Member
    Project Admin
    Admin

​
Changing roles after the fact

capy users opens an interactive members list - Capy’s TUI for inspecting and editing roles in the org. Press r on a row to change that user’s role, Enter to expand a member and see their per-project roles and protected-branch grants. 
  Organization Members (3 users)

  Email                          Role           Added         Projects
  ─────────────────────────────────────────────────────────────────────
> alice@acme.com                 owner          2025-01-15    2 projects
  bob@acme.com                   member         2025-02-03    1 project
  carol@acme.com                 admin          2025-03-10    2 projects
  ─────────────────────────────────────────────────────────────────────
   ↑↓ navigate  Enter expand/collapse  r change role  g grant protected  q quit
When you press r, an inline picker replaces the role cell with the available options. Pick one and the change applies immediately. 
  Email                          Role           Added         Projects
  ─────────────────────────────────────────────────────────────────────
  alice@acme.com                 owner          2025-01-15    2 projects
> bob@acme.com                   ❯ admin                      1 project
                                   project-admin
                                   member
  ─────────────────────────────────────────────────────────────────────
   ↑↓ pick role  Enter confirm  Esc cancel
Expanding a member with Enter shows the projects they belong to plus any protected branches they hold a grant on, and lets you change their per-project role from the same view.

​
Protected branches narrow access further

Org-level role and protected-branch membership are two separate things. An Admin doesn’t automatically have access to every protected branch - they still need to be granted access to each protected branch individually. The org role controls who can invite; protected-branch membership controls who can decrypt.

​
What’s next

Inviting users

The redeem-code flow.

Protected branches

Per-branch access lists.