Shelve

Development teams typically juggle API keys, tokens, and environment variables across scattered .env files, manual sharing, and inconsistent configurations between development, staging, and production. This leads to runtime errors from missing or mismatched variables, secrets leaking into places like AI coding agent context windows, and broad-power tokens that increase blast radius if leaked. Manually copying env files between team members and CI systems is slow, described on the page as taking about 5 minutes per manual share versus 5 seconds with Shelve. Without centralized auditing, teams also lack visibility into who changed which secret, when, and from where.

Shelve centralizes secrets in a single dashboard and syncs them across environments via a CLI, GitHub App integration, and a REST API. Secrets are protected with envelope encryption: each variable is encrypted with a per-project Data Encryption Key (AES-256-GCM), which is itself sealed by a platform-wide Key Encryption Key, so a compromised project key does not expose the whole instance. Teams can issue scoped, expiring API tokens with IP allowlists that are stored hashed and shown only once, and every security-relevant action (variable edits, token creation, team changes) is captured in a filterable, append-only audit log. The product also detects environment inconsistencies (an 'Environment Sync' check), supports role-based team access (Owner, Admin, Member), automatically syncs secrets to GitHub Actions, and is built to be safe with AI coding agents by generating .cursorignore/.aiderignore files and injecting secrets into process memory at runtime instead of writing them to disk.