Shelve
Your secure foundation for effortless secrets management
Is this your product? Claim it to edit the listing, post updates and answer questions. Prove it with an email address at the product's domain (the listing becomes Claimed), or put the LotsDirectory badge on your website (the listing becomes Verified, and its link to your website is followed while the badge is live).
Description
Your secure foundation for effortless secrets management
About Shelve
What is Shelve?
Shelve is an open-source platform for application secrets, API keys, tokens, and environment variables. It is free to self-host, and the hosted instance is currently free to use. Envelope encryption, scoped tokens, and audit logs are in the open-source core.
What Shelve does
Each variable is encrypted with a per-project Data Encryption Key using AES-256-GCM, and that key is sealed by a platform Key Encryption Key. API tokens can be scoped to teams, projects, environments, or permissions, with optional expiry and an IP allowlist. Tokens are shown once and stored as a SHA-256 hash. Audit logs have captured team, project, variable, and token actions with actor, IP, user agent, and resource context. The CLI command shelve init writes ignore files so a coding agent does not read a raw env file, and shelve run injects variables into process memory. GitHub Actions secrets and repository secrets can be synced through the GitHub App.
Who Shelve is for
Shelve is for developers and teams who keep API keys, tokens, and environment variables in one dashboard, and who want a self-hosted or hosted secrets platform with role-based access.
How Shelve works
Create a project, add a secret variable, and manage environments. Roles listed are Owner, Admin, and Member. Connect a GitHub repository with the GitHub App to sync secrets. The command center is opened with Cmd+K or Ctrl+K. A self-hosted instance can be deployed with Vercel, and that deploy keeps the Key Encryption Key, the database, and the audit trail.
Key features
- Envelope encryption uses a per-project Data Encryption Key with AES-256-GCM, sealed by a platform Key Encryption Key.
- API tokens can be scoped, set to expire, and restricted with an IP allowlist. Tokens are shown once and stored hashed.
- Audit logs captured actor, IP, user agent, and resource context, and the feed is open to a query through the API.
- shelve init writes ignore files for coding agents, and shelve run injects variables into process memory with zero disk writes.
- CLI tokens live in the OS keychain. The FAQ lists Keychain, Credential Vault, and libsecret.
- The GitHub App syncs GitHub Actions secrets and repository secrets.
- Team roles are Owner, Admin, and Member.
- The hosted instance is currently free, and self-hosting is supported, including a Vercel deploy.
Facts from shelve.cloud, checked 15 October 2026
Written from Shelve's own website (Homepage, Docs). The maker can claim this listing to edit it.
Categories
Frequently asked questions
Is Shelve free?
Shelve is open source and free to self-host. The hosted instance is currently free to use, and the security features on the page ship in the open-source core.
How does Shelve encrypt secrets?
Each variable is sealed with a per-project Data Encryption Key using AES-256-GCM, and that key is sealed with a platform Key Encryption Key. Plaintext never lands in the database.
How are API tokens stored?
Tokens are generated from a Crockford-base32 alphabet, displayed once, then stored as a SHA-256 hash with a short non-secret prefix. They can be scoped to teams, projects, environments, and permissions, with an expiry and an IP allowlist.
Can Shelve be self-hosted?
Yes. A self-hosted instance can be deployed using Vercel, and that deploy keeps the Key Encryption Key, the database, and the audit trail.
Is Shelve safe with an AI coding agent?
shelve init writes ignore files such as .cursorignore, .aiderignore, and .codeiumignore. shelve run injects variables into the spawned process memory with zero disk writes. CLI tokens live in the OS keychain.