Can I see it work before signing up?

Yes. The demo at the top of this page is the product in miniature: run a command, be refused, request access with a reason, approve it, and run the command again. The console and the terminal share state the way they do in the real workspace. Nothing there touches a server, and every value in it is invented.

What is Shortspan, in plain terms?

Shortspan is a shared workspace for the secrets, infrastructure connections, and operational tasks your engineering team uses. The web console is where you organize resources and manage access. The CLI is where you use those resources in your everyday work.

How is this different from a password manager?

Shortspan focuses on development and operations workflows: injecting secret groups into a process, connecting to infrastructure by alias, requesting temporary access, and executing versioned runbooks. It brings those workflows together with project permissions and audit history.

Do we have to move everything at once?

No. Start with one project and a group of development secrets, or register a single infrastructure target. Add more resources, team members, and runbooks as you need them.

Are all credentials temporary?

No. Temporary access grants and scoped tokens can expire, but stored infrastructure credentials may remain valid at their source. Shortspan encrypts stored secrets and checks access when they are requested. Revoking access to Shortspan is not the same as rotating an underlying database password or cloud key.

What do I need to use the CLI?

You need a Shortspan account, the CLI, and access to a configured project. Sign in through the browser with shortspan login, select your organization and project, then use the relevant command. Database and cloud workflows also require their native tools.

Can I use it on my own or with a team?

Both. You can organize your own projects or manage a shared workspace for a team. Resource limits and features such as team management, audit access, and version history depend on your plan. The pricing page has the current breakdown.

For the people who build and run software

Secrets, access,
and operations.
In one place.

Give your team one workspace for secrets, servers, databases, and cloud. Manage access in the web console. Get work done from the command line.

Create your workspace Try it without signing up

Start with one project. Bring your team when you’re ready.

Try it - nothing to install, no account

The console and the terminal, wired to each other.

Run a command, get refused, ask for access, approve it, and connect. This is the working product in miniature - the same loop, with invented data.

acmeplatform

Secrets

Values stay encrypted. Reading one in plaintext is a separate, recorded action.

DATABASE_URL
Development · connection · updated 3 days ago
••••••••••••••••••••••••
SENTRY_DSN
Development · url · updated 3 days ago
••••••••••••••••••••••••
STRIPE_SECRET_KEY
Production · api_key · updated 11 days ago
Production · reveal needs an approved grant
PAYMENTS_DB_URL
Production · connection · updated 11 days ago
Production · reveal needs an approved grant

you@laptop · ~/acme/platform

Signed in

Organization acme

Project platform

Role developer

Tip Type a command, or press ↑ for the last one. `help` lists everything.

Walk the whole loop

0/5

Sample data. Every value here is invented and works nowhere.

One workflow, across your stack

App secrets
SSH
Databases
AWS & Kubernetes
Runbooks

The whole workflow, connected

Less chasing credentials.
More moving work forward.

The API key in a chat. The server details in a document. The deploy steps only one person knows. Give all of it a home your team can work from.

A home for your secrets

Keep API keys, environment variables, certificates, and connection details in an encrypted vault. Bundle related secrets into groups and inject them into your applications.

Typed templates · Secret groups · Version history

Your infrastructure, connected

Register SSH servers, databases, AWS accounts, and Kubernetes clusters. Connect by a memorable alias, including database connections through an SSH bastion.

SSH · PostgreSQL & MySQL · AWS · Kubernetes

Access with an expiry date

Let teammates request the access they need and explain why. Administrators approve or deny requests, and temporary grants expire automatically.

Requests · Approvals · Temporary grants

Operations you can repeat

Turn deployment steps and maintenance tasks into versioned runbooks. Review changes, require approval when needed, and track each execution.

Versioned plans · Approvals · Execution history

A workspace for your team

Organize resources by project and environment. Assign owner, admin, developer, or viewer roles, and give automation its own scoped API tokens.

Projects · Team roles · Scoped tokens

A record of what happened

Follow sensitive actions across your workspace. See the actor, resource, and time behind an event so access reviews start with a record, not a guess.

Audit events · Resource history · Device activity

Feature availability and resource limits vary by plan. Compare plans

What it brokers

Register it once.
Reach it by name.

Each resource is configured in the console and then used from the CLI. Nobody copies a credential out to use it, and nothing has to live in a local dotfile.

Resource	Configured in the console	Used from the CLI
Application secrets	A secret group per environment, typed by template	`shortspan run "Production" -- npm start`
SSH servers	Host, login user, and a pinned host key	`shortspan ssh prod-web`
PostgreSQL & MySQL	Connection details, optionally behind a bastion	`shortspan db analytics-db --via bastion`
AWS accounts	Stored credentials scoped to a project	`shortspan aws staging --exec "aws s3 ls"`
Kubernetes clusters	Cluster endpoint and its kubeconfig context	`shortspan k8s staging-cluster`
Operational runbooks	Versioned steps, a target, and an approval policy	`shortspan runbook run deploy-api`

How it works

Set it up in the console.
Put it to work in your terminal.

A shared place to manage the work, and a familiar way to do it.

01
WEB CONSOLE
Organize your workspace
Create a project, add a secret group or infrastructure target, and assign the right people to it.
02
SHORTSPAN CLI
Connect and get to work
Sign in to the CLI, choose your project, and run your app, connect to a server, or execute a runbook.
03
CONSOLE + CLI
Stay in control together
Review access requests, follow activity, and update permissions as your team and projects change.

Built for your everyday tools

Your workflow. A shorter command.

Keep using your shell, database clients, and cloud tools. Let Shortspan handle the project context and access to the credentials they need.

Start your app. Bring its secrets.

Create a secret group in the console, then pass its name to the CLI. Shortspan injects the values into the child process environment, so you do not need to copy them into a local .env file.

Read the documentation

Example command

shortspan run "Development" -- npm start

“Development” is an example secret group in your active project.

First time here?

Install the CLI, run shortspan login, then select your organization and project. Follow the setup guide.

How access actually works

Nobody holds a credential.
They hold the right to ask.

The same five steps sit behind every resource type, whether it is a production database or a deploy runbook.

01Console
Register the resource, not the credential
An administrator adds the server, database, cloud account, or secret group once. The underlying credential is encrypted and never shown again.
02CLI
Ask, with a reason attached
A developer who needs production runs one command. The reason and the duration travel with the request, so an approver is not guessing.
03Console
Approve for as long as it takes
An administrator sees who asked, for what, and why. Approving grants access for a bounded window rather than for good.
04CLI
Use a credential you never hold
The broker mints a short-lived credential for the session and hands the session to you, not the key. Nothing lands in a dotfile.
05Both
It expires. The record stays.
The grant lapses without anybody remembering to revoke it, and the request, the approval, and the session remain in the audit trail.

Who can do what

Four roles, and no
surprises in the middle.

A developer can use every resource assigned to their projects without being able to print a credential. Anything beyond that is asked for, and answered by a person.

Ability	Owner	Admin	Developer	Viewer
Manage resourcesCreate and remove secrets, targets, and runbooks	Allowed	Allowed	Not by default	Not by default
Reveal a secretPrint a stored value in plaintext	Allowed	Allowed	Not by default	Not by default
Approve requestsDecide on temporary access and gated runbooks	Allowed	Allowed	Not by default	Not by default
Read the audit trailReview who acted, on what, and when	Allowed	Allowed	Not by default	Not by default

A developer without reveal can still ask for it. Requests carry a reason and a duration, and the grant lapses on its own.

For the work that needs a little more care

Give people access.
Keep control.

Shipping quickly and knowing who can reach production should belong in the same workflow. Set the boundaries once, then keep the decisions and activity visible.

Explore the security model

Permissions with a purpose

Separate the people who administer a workspace from those who use its resources. Scope automation tokens to the work they need to do.

Approval before sensitive work

Review temporary access requests and require approval for selected runbooks before execution.

Context after the work is done

Use audit events and execution history to understand who acted, on which resource, and when.

Install

One command, then you are in.

The installer asks this deployment which build matches your machine, checks the published SHA-256 before unpacking it, and refuses to install anything it cannot verify.

Terminal

curl -fsSL https://shortspan.dev/install.sh | sh

Installs to /usr/local/bin, or ~/.local/bin when that is not writable.

Prefer to do it yourself? Every release publishes checksums alongside the archives. All installation methods.

A few useful answers

Get to know
Shortspan.

What it does, where it fits, and what to expect before you get started.

A better place to start

Your next project.
A little more under control.

Start with the secrets and connections you use every day. Build the rest of your team’s workflow from there.

Create your workspace Explore plans

Secrets, access, and operations. In one place.

The console and the terminal, wired to each other.

Secrets

Walk the whole loop

Less chasing credentials.More moving work forward.

A home for your secrets

Your infrastructure, connected

Access with an expiry date

Operations you can repeat

A workspace for your team

A record of what happened

Register it once.Reach it by name.

Set it up in the console.Put it to work in your terminal.

Organize your workspace

Connect and get to work

Stay in control together

Your workflow. A shorter command.

Start your app. Bring its secrets.

Nobody holds a credential.They hold the right to ask.

Register the resource, not the credential

Ask, with a reason attached

Approve for as long as it takes

Use a credential you never hold

It expires. The record stays.

Four roles, and nosurprises in the middle.

Give people access.Keep control.