Shelve review
A focused open-source vault for teams managing secrets across GitHub and Coolify.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Shelve is an open-source platform for centralizing secrets and environment variables across projects and environments. It is aimed at developers and development teams that need shared control over API keys, tokens, and configuration values across development, preview, and production. Shelve offers web and API access, a hosted instance, and self-hosting through Vercel. Its environment parity checks also help teams compare configuration across deployment stages.
The product’s strongest fit is its combination of security controls and delivery workflows. Each project uses envelope encryption with AES-256-GCM, while scoped and expiring API tokens can include optional IP allowlists. Role-based access control separates team and project permissions, and append-only audit logs are available through a REST API. The CLI injects secrets at runtime into applications, CI workflows, containers, and other processes without writing a plaintext .env file. An encrypted offline CLI cache supports access when the CLI is not connected. GitHub Secrets synchronization through a GitHub App and Coolify integration make Shelve particularly relevant to open-source teams building around those platforms.
Shelve is currently free as a hosted instance and is free to self-host, giving teams a straightforward way to adopt it without a paid tier structure. That makes it a practical choice for teams that value open-source deployment options and focused environment management. Its scope is narrower for organizations that require secret rotation workflows or Kubernetes-specific support. Those teams should consider a broader alternative, while teams using GitHub and Coolify should find Shelve’s synchronization, runtime injection, access controls, and audit trail closely aligned with their workflow.
Shelve pros and cons
- Where it wins
- Free hosted instance and self-hosting support
- CLI injection avoids writing plaintext .env files
- GitHub synchronization, RBAC, audits, and expiring tokens
- Where it doesn't
- No listed secret rotation workflows
- No Kubernetes-specific support
- Feature breadth is narrower than broader secrets platforms
Shelve fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update