KeyEnv vs Shelve
KeyEnv
keyenv.devShelve
shelve.cloudSide by side
| Figure | KeyEnv | Shelve |
|---|---|---|
| Price from | $3.33/mo | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 4 | 2 |
| Spec score · Secrets Management Tools | 8.4 (#6) | 7.4 (#24) |
| Encryption | The maker says secrets are encrypted on the device using AES-256-GCM and that KeyEnv does not have access to the encryption keys or plaintext secrets. | Shelve describes per-project envelope encryption using AES-256-GCM, with each project’s data key sealed by a platform key. |
| Support | The Free plan includes community support, the Team plan includes priority support, and Enterprise includes dedicated support. | The maker lists GitHub issues and [email protected] for support and contributions. |
| Transport security | The security page says data in transit is protected by TLS 1.3 and key derivation uses Argon2id. | The encryption documentation says traffic to the hosted app uses TLS 1.3; self-hosted deployments should configure HTTPS at their proxy or platform. |
Plans
KeyEnv
- FreeFree
- Team$4 a month
- Team (annual billing)$40 a year
- EnterprisePriced on request
In their own words
KeyEnv
KeyEnv manages environment variables and secrets across development workflows. Its CLI lets teams run, inject, and manage secrets from the terminal, while separate development, staging, and production configurations allow environment-specific overrides. A scanner checks for hardcoded keys, tokens, and passwords across more than 149 patterns. KeyEnv can schedule PostgreSQL and MySQL credential rotation using a two-secret approach intended to avoid downtime. Integrations include SDKs, GitHub Actions, Bitbucket Pipelines, serverless tools, and frameworks such as Next.js, Django, Laravel, Spring Boot, and Rails. The maker says secrets are encrypted on the device with AES-256-GCM and that it cannot access encryption keys or plaintext secrets; data in transit uses TLS 1.3, with Argon2id for key derivation. Access controls include roles, environment isolation, revocable scoped tokens, and audit logs. KeyEnv runs on Linux, macOS, web, API, and self-hosted deployments. The Free plan includes up to three projects and 100 secrets per environment. Team is $3.33/user/mo (annual) or $4.00 per user/month; new accounts get a 14-day Team-feature trial without a credit card.