Shelve

Overview:

Shelve is an open-source secrets management tool that centralizes, secures, and synchronizes environment variables and secrets for development teams. It addresses the friction and security risks of managing .env files and scattered keys across projects and environments. Designed for developers, it provides a unified platform for storing API keys, tokens, and variables with encryption at rest, alongside a command palette, a CLI, and team collaboration features. The project is in active development and aims to evolve into a broader developer workspace hub.

Core Features:

• Centralized vault: Securely stores API keys, tokens, and environment variables in an organized dashboard with encryption (SHA-256 hashing, AES-256 at rest).

• Environment parity: Manages configurations across dev, staging, production, and custom environments.

• Command palette (Cmd+K): Enables instant search, navigation, and action execution within the UI.

• CLI sync: shelve pull and shelve push commands allow fetching and injecting secrets directly from the terminal, including a shelve run command.

• GitHub integration: Syncs secrets with GitHub Actions and repository secrets through an official GitHub App.

• Team collaboration: Supports workspaces and role-based access control with Owner, Admin, and Member roles.

Use Cases:

• Developers managing multiple projects: Centralize environment variables across dev, staging, and production to avoid manual .env file juggling.

• Teams needing consistent configuration: Use workspaces and role-based access to ensure all members have the correct secrets for their projects.

• CI/CD pipeline setup: Sync secrets with GitHub Actions automatically via the official GitHub App to streamline deployments.

• Self-hosters seeking data control: Deploy Shelve on Vercel or via Docker/Coolify options to manage secrets on their own infrastructure.

Why It Matters:

Shelve provides an open-source, self-hostable option for secrets management that emphasizes developer experience through a CLI, command palette, and clean UI. Its built-in GitHub sync and workspace-based permissions make it practical for teams already using GitHub Actions or needing structured access control. The project does not paywall core features and publishes under the APACHE-2.0 license, offering transparency and community-driven development. For teams looking for a centralized secrets vault with minimal setup friction, Shelve fills a gap between manual management and proprietary alternatives.