Skip to content
SPECIFICTION
Get listed

Envshed

envshed.com

From $5/mo Free plan WebWindowsmacOSLinuxAPI
Visit envshed.com
Spec score 9.3 #1 of 46 in Secrets Management Tools

What it is

Envshed is a cloud secrets manager for small engineering teams, with a CLI that works across monorepos. It manages secrets and environments, supports per-user overrides, warns about expirations, allows project duplication and keeps an audit trail. For pnpm or npm workspaces, the CLI can detect workspaces and retrieve secrets from the repository root. Listed integrations include GitHub Actions, Docker, a Node.js SDK, a CLI for any shell and Coolify; a REST API supports languages including Python, Go and Rust. Secret values are encrypted at rest with AES-256-GCM, traffic uses TLS 1.3, and encryption keys are held separately from encrypted data. Envshed offers role-based access control and an immutable audit trail, including records of secret reads and changes. The maker says it is not a zero-knowledge vault: a small on-call group with production credentials could technically decrypt a secret value. Data is stored in one region on US-based cloud infrastructure. Self-hosting is unavailable, and the service is not yet SOC 2 or ISO 27001 certified. The Developer plan is free forever for up to two members and three projects; Team is $5/user/month and Business is $9/user/month.

Spec sheet

What it does
Envshed provides encrypted secrets management for organizations, projects, and environments.Read 15 Oct 2026 · docs.envshed.com
Product
Envshed is an encrypted, monorepo-native secrets manager for small engineering teams.Read 7 Oct 2026 · envshed.com
Intended users
The maker targets indie developers, early-stage startups of up to about 50 engineers, and open-source maintainers running shared infrastructure.Read 7 Oct 2026 · envshed.com
API
The maker says Envshed offers a REST API for use from languages including Python, Go, and Rust.Read 7 Oct 2026 · envshed.com
Integrations
Shipped integrations include GitHub Actions, Docker, Node.js SDK, a shell-independent CLI, and Coolify.Read 15 Oct 2026 · envshed.com
Security
Secret values are encrypted at rest with AES-256-GCM, traffic uses TLS 1.3, and encryption keys are held separately from encrypted data.Read 7 Oct 2026 · envshed.com
Compliance
Envshed says it is not yet SOC 2 or ISO 27001 certified and that SOC 2 Type II is on its roadmap.Read 7 Oct 2026 · envshed.com
Support
The site offers priority support on Business and directs security questionnaires to [email protected].Read 15 Oct 2026 · envshed.com
Access and audit
The maker describes role-based access control and an immutable audit trail, including records of secret reads and changes.Read 7 Oct 2026 · envshed.com
Access control
The platform describes organization, project, and environment roles including owner, admin, editor, and viewer.Read 15 Oct 2026 · envshed.com
Audit trail
Reads and writes are recorded with user, IP address, timestamp, and change information.Read 15 Oct 2026 · envshed.com
Changelog: installer
On April 16, 2026, Envshed announced a dedicated install.envshed.com host for CLI installation flows.Read 15 Oct 2026 · envshed.com
Changelog: SAML
On March 15, 2026, SAML 2.0 sign-in through Okta, Azure AD, Google Workspace, and other providers was added to Business.Read 15 Oct 2026 · envshed.com
Changelog: service tokens
On March 18, 2026, scoped machine-to-machine service tokens for CI/CD were announced.Read 15 Oct 2026 · envshed.com
CLI
The envshed CLI can pull, push, inject, import, run, version, snapshot, and roll back secrets.Read 15 Oct 2026 · docs.envshed.com
Data residency
The service currently stores data in a single region on US-based cloud infrastructure.Read 15 Oct 2026 · envshed.com
Documentation depth
The documentation site contains getting-started material, a CLI reference with numerous subcommands, feature pages, integrations, configuration, and migration guidance.Read 15 Oct 2026 · docs.envshed.com
Encryption
Secret values are encrypted at rest with AES-256-GCM and traffic uses TLS 1.3.Read 15 Oct 2026 · envshed.com
GitHub Action inputs
The documented action accepts token, organization, project, environment, API URL, export mode, and file path inputs.Read 15 Oct 2026 · docs.envshed.com
GitHub Actions
The GitHub Actions integration fetches secrets and exports masked variables or writes a .env file.Read 15 Oct 2026 · docs.envshed.com
Key features
It provides a CLI, secret and environment management, per-user overrides, expiration warnings, project duplication, and an audit trail.Read 7 Oct 2026 · envshed.com
Limit: outage behavior
Already-pulled .env files continue working during an outage, but fresh envshed pull requests require the API to be available.Read 15 Oct 2026 · envshed.com
Limit: self-hosting
Self-hosting is unavailable today and is described only as a future enterprise roadmap item without a committed date.Read 15 Oct 2026 · envshed.com
Maker audience
Envshed targets indie developers, open-source maintainers, and startups with roughly 2 to 50 engineers.Read 15 Oct 2026 · envshed.com
Monorepo support
The CLI detects pnpm or package.json workspaces and maps subdirectories through one root .envshed.json file.Read 15 Oct 2026 · envshed.com
Monorepos
The CLI detects pnpm or npm workspaces and can pull secrets for every workspace from the repository root.Read 7 Oct 2026 · envshed.com
Node SDK
The @envshed/node package provides JavaScript and TypeScript access to the Envshed REST API.Read 15 Oct 2026 · socket.dev
Node SDK activity
Socket reports version 0.2.0, one maintainer, and 187 weekly downloads for the package.Read 15 Oct 2026 · socket.dev
Node SDK licence
The @envshed/node package is licensed under MIT.Read 15 Oct 2026 · socket.dev
Node SDK modules
The package publishes both ESM and CommonJS builds.Read 15 Oct 2026 · socket.dev
Node SDK resilience
The SDK includes automatic retries with exponential backoff for transient failures.Read 15 Oct 2026 · socket.dev
Node SDK runtime
The SDK uses native fetch, has zero runtime dependencies, and requires Node.js 18 or newer.Read 15 Oct 2026 · socket.dev
Node SDK typing
The package includes first-class TypeScript support with exported type definitions.Read 15 Oct 2026 · socket.dev
REST API
Envshed documents programmatic REST API access using Bearer token authentication.Read 15 Oct 2026 · docs.envshed.com
Roadmap integrations
The site lists Vercel, GitLab CI, Python SDK, Netlify, CircleCI, Terraform, AWS Secrets Manager, and Kubernetes integrations as planned or pending.Read 15 Oct 2026 · envshed.com
Secret expiration
Secrets can have expiration dates with dashboard and CLI warnings before and after expiry.Read 15 Oct 2026 · envshed.com
Secret references
Values can reference other secrets with ${KEY} or ${env.KEY} syntax resolved at read time.Read 15 Oct 2026 · docs.envshed.com
Security certification
Envshed says it is not yet SOC 2 or ISO 27001 certified and has SOC 2 Type II on its roadmap.Read 15 Oct 2026 · envshed.com
Self-hosting
Self-hosting is not currently available; the maker lists it as planned without a committed date.Read 7 Oct 2026 · envshed.com
Service tokens
Service tokens support scoped read-only or read-write machine authentication for CI/CD.Read 15 Oct 2026 · envshed.com
Zero knowledge
Envshed states that it is not a zero-knowledge vault and that an on-call group with production credentials could technically decrypt values.Read 15 Oct 2026 · envshed.com

Plans and prices

Developer Free free forever up to 2 members · up to 3 projects · unlimited secrets · AES-256-GCM encryption · CLI & API access Read 15 Oct 2026 · envshed.com
Team $5 a month $5/user/month unlimited members · unlimited projects · unlimited secrets · CLI & API access · webhooks · service tokens · audit logs Read 15 Oct 2026 · envshed.com
Business $9 a month $9/user/month everything in Team · SAML SSO · priority support Read 15 Oct 2026 · envshed.com

Every Envshed plan and price →

Strong points and limits

Strong points

  • CLI retrieves workspace secrets from a monorepo root
  • Supports GitHub Actions, Docker and Coolify
  • Uses AES-256-GCM encryption at rest and TLS 1.3
  • Audit trail records secret reads and changes

Limits

  • Self-hosting is not currently available
  • Not yet SOC 2 or ISO 27001 certified
  • Not a zero-knowledge vault
  • Data is stored in one US-based region

Who it suits

Envshed targets indie developers, early-stage startups of up to about 50 engineers, and open-source maintainers running shared infrastructure. Its CLI and workspace detection suit teams working in monorepos.

Envshed in depth

Read the full write-up

Envshed is a cloud secrets manager built for small engineering teams, especially those keeping several workspaces in one monorepo. Its root-level workspace workflow is a practical differentiator, but teams with strict control over where secrets can be decrypted or hosted should weigh its security and deployment limits carefully.

Overview

Envshed combines secret and environment management with per-user overrides, expiration warnings, project duplication, and audit records. Its CLI detects pnpm and npm workspaces and can pull secrets for all workspaces from the repository root, which suits teams sharing configuration across packages. The feature set is focused: secret rotation and dynamic secrets are not supported, so it is a weaker fit for teams that need automated credential cycling or short-lived credentials.

Key features

Developer workflows

The CLI works in any shell, and the maker lists GitHub Actions, Docker, Node.js SDK, and Coolify as integrations. A REST API supports use from languages including Python, Go, and Rust. CI/CD injection is supported; the Team plan adds service tokens for CI/CD. This provides several ways to connect secrets to development and deployment workflows, although teams using Kubernetes will not find a dedicated integration.

Security and access

Secret values are encrypted at rest with AES-256-GCM, traffic uses TLS 1.3, and encryption keys are kept separately from encrypted data. Role-based access control and an immutable audit trail record secret reads and changes, useful safeguards for shared team access. The boundary matters: Envshed is not zero-knowledge, and a small on-call group with production credentials could technically decrypt secrets. Data is stored in a single region on US-based cloud infrastructure. The service is not currently SOC 2 or ISO 27001 certified; SOC 2 Type II is on its roadmap.

Self-hosting is not available today, though it is planned without a committed date. Teams that require deployment in their own environment, zero-knowledge storage, or current certification should choose a different tool.

Pricing

The Developer plan is free forever and includes up to 2 members, up to 3 projects, unlimited secrets, AES-256-GCM encryption, and CLI and API access. It is a useful way for an individual or very small team to start, but the member and project caps make it unsuitable for a growing shared setup.

Team costs $5/user/month and includes unlimited members, projects, and secrets, CLI and API access, webhooks, service tokens for CI/CD, and audit logs. It is the natural fit for teams that need shared workflows and auditability. Business costs $9/user/month and adds SAML SSO and priority support to everything in Team, making it the relevant upgrade for organizations requiring SSO or faster support. A 14-day trial is available. The prices are per user per month, so costs rise with team size.

Platforms

Envshed is a cloud deployment with support for API, Linux, macOS, web, and Windows. Its CLI and API access suit engineering workflows across those environments, but the platform list does not change the cloud-only deployment model.

Who it's for

Envshed targets indie developers, early-stage startups of up to about 50 engineers, and open-source maintainers running shared infrastructure. It is most compelling when those teams use pnpm or npm workspaces and want a common place for secrets, access controls, and audit history. Larger or more regulated teams may find the missing certifications, US-only single-region storage, and lack of self-hosting or zero-knowledge encryption decisive.

Pros and cons

Monorepo-aware CLI: retrieves secrets for every pnpm or npm workspace from the repository root, reducing friction for multi-package repositories.

Useful shared-team controls: role-based access control and immutable audit records cover reads and changes, while Team adds service tokens and webhooks.

Several integration paths: shell-compatible CLI, REST API, and integrations including GitHub Actions, Docker, Node.js SDK, and Coolify support varied workflows.

No rotation or dynamic secrets: teams needing automated rotation or ephemeral credentials must look elsewhere.

Cloud-only and not zero-knowledge: self-hosting is unavailable, and privileged on-call staff could technically decrypt secrets.

Certification and residency constraints: it is not currently SOC 2 or ISO 27001 certified, and data resides in one US-based region.

Alternatives

Browse secrets management tools to compare the wider category. Choose Infisical if its free plan's 5 identities, unlimited projects, and 100+ integrations better suit your requirements, or if you need Linux, Windows, web, API, and self-hosted platform options. Phase may be a better fit for up to 5 users or service accounts across 3 apps and 3 environments, with self-hosted support and OAuth SSO on its free plan. Consider secr if a free allowance of 3 projects, 100 secrets, one AI agent, and a 7-day audit log matches your scale, or if its listed extension platform matters to your workflow. Choose dotenvx if free, open-source software with CLI, SDKs, and secret encryption is the priority, or if self-hosting matters. KeyEnv is an alternative if its free plan's end-to-end encryption, CLI access, and caps of 3 projects and 100 secrets per environment fit your needs, particularly if self-hosting is important. BeyondTrust Remote Support is another option, with custom pricing and a broad platform range that includes self-hosted deployment. Doppler may suit teams willing to pay $8/mo per additional user after 3 free users, with 5 config syncs and 3 days of activity history on its Developer plan. Consider Keyway if its Pro plan at 9€/month for 10 private repos, unlimited environments, and unlimited collaborators better matches your repository needs.

Verdict

Envshed is a strong fit for small engineering teams that want monorepo-aware secret retrieval, shared access controls, and an audit trail without building those workflows around separate tools. Its clearest reason to choose it is pulling secrets for every workspace from the repository root; its clearest reason to look elsewhere is the combination of cloud-only hosting, non-zero-knowledge access, and absent current compliance certification.

Verdict

Envshed offers monorepo-aware secrets management with CLI, API and audit features. Teams requiring self-hosting, zero-knowledge storage or current SOC 2 or ISO 27001 certification should note those limits.

Where Specifiction places it

Alternatives to EnvshedAll alternatives →