Shelve
Centralize, encrypt, and sync application secrets with per-project keys, scoped tokens, and audit logs. Built for teams and AI coding agents with GitHub integration.
Shelve is your secure foundation for effortless secrets management. Centralize API keys, tokens, and environment variables in one organized dashboard while ensuring team access and seamless synchronization across environments.
Key Features
- Envelope Encryption: Every variable encrypted with a per-project Data Encryption Key (DEK), sealed by a platform Key Encryption Key (KEK). Leaked DEKs scope to single projects, and key rotation doesn't touch application code.
- Scoped API Tokens: Create tokens with fine-grained permissions, optional expiry, and IP allowlists. Tokens are hashed and shown once with full audit logging.
- AI Agent Safe: Automatically provisions
.cursorignore,.aiderignore, and.codeiumignorefiles. Tokens stored in OS keychain with zero disk writes during runtime injection. - Environment Parity: Detects inconsistencies across environments instantly to prevent runtime errors caused by missing variables.
- Team Management: Role-based access (Owner, Admin, Member) with clear permissions and secure team collaboration.
- GitHub Integration: Official GitHub App syncs secrets automatically between Shelve and GitHub Actions/repository secrets.
- Command Center: Hit Ctrl+K (Cmd+K) for instant search, navigation, and action execution across your workspace.
- Audit Everything: Immutable, filterable audit logs capture all security-relevant actions with actor, IP, user agent, and resource context.
Tech / Self-Hosting
Shelve is open source and free to self-host. The hosted instance at app.shelve.cloud includes all security features. Built with modern web technologies and designed for seamless integration with CI/CD pipelines and development workflows.