Comparison
Shortspan vs Doppler
Doppler is a focused secrets manager for application configuration. Shortspan stores application secrets too, but its centre of gravity is getting people onto servers, databases, and cloud accounts without handing them credentials.
The short answer
If your problem is environment variables across many services, platforms, and CI pipelines, Doppler is the more complete tool: syncs, a Kubernetes operator, rotation, SAML SSO, and a SOC 2 report. If your team also shares SSH keys, database passwords, and cloud credentials and wants approvals and an audit trail around them, Shortspan covers ground Doppler does not.
Choose Doppler if
- Your secrets need to reach platforms and CI systems through syncs, not only a CLI.
- You need automatic secret rotation or dynamic secrets.
- You need SAML SSO or SCIM today.
- You have a team of up to three and want it free - Doppler’s Developer plan covers three users.
- You need a vendor with SOC 2 and ISO 27001 certification.
Choose Shortspan if
- You need SSH, database, AWS, and Kubernetes access brokered for people, not only secrets delivered to applications.
- You want temporary access requests with approval and automatic expiry.
- You want versioned, approval-gated runbooks.
- A flat team price suits you: Team is $49 per month · 5 users included.
Side by side
Doppler and Shortspan, capability by capability.
| Capability | Doppler | Shortspan |
|---|---|---|
| Primary job | Application secrets and configuration across environments, delivered by CLI injection and syncs to cloud platforms and CI. Source | One broker for application secrets and infrastructure access (SSH, databases, AWS, Kubernetes), used from a single CLI. |
| How it runs | Hosted. The Enterprise plan lists an on-premises option. Source | Hosted service. Self-hosting is listed as coming soon for Enterprise. Source |
| Source code and licence | The platform is proprietary. The CLI is open source under Apache 2.0. Source | Proprietary. The source code is not public. |
| Pricing | Developer: free for 3 users, then $8 per additional user per month. Team: $21 per user per month. Enterprise is quoted. Source | Free for one user. Pro $12 per month. Team $49 per month · 5 users included. Enterprise is quoted. |
| Application secrets | Its core product. | Encrypted, versioned, project-scoped secrets with typed templates and named groups injected into a process with |
| Credentials generated per request | Dynamic secrets on Enterprise. Automatic secret rotation from the Team plan. Source | No. Stored credentials are released for a short-lived grant; the credential itself stays valid until you rotate it. Dynamic credentials are listed as coming soon. Source |
| SSH server access | Doppler can store an SSH key as a secret, but it does not broker SSH sessions. | Brokers the stored key or password into the CLI’s memory for one session. Nothing is installed on the server, and traffic does not pass through Shortspan. Per-server host-key pinning, exec, and port-forwarding policy. Source |
| Database access | Stores and rotates database credentials as secrets; it does not open database connections. | PostgreSQL and MySQL. Connects directly, through a registered SSH bastion, or by running the client on the server. Source |
| Kubernetes access | A Kubernetes operator syncs secrets into clusters. It does not broker kubectl access for people. Source | Releases a stored kubeconfig to a temporary file for one subshell and removes it on exit. Source |
| AWS access | Stores AWS keys as secrets and syncs to AWS services; it does not broker AWS sessions. | Releases stored AWS access keys into one subshell’s environment; nothing is written to ~/.aws. It does not mint temporary STS credentials. Source |
| Access requests with approval | Change requests on Team and change-request policies on Enterprise - approval for changing secrets rather than for temporary access. Source | Yes, on the Team plan. A required reason, a 1–72 hour window, approval by someone else, and automatic expiry. Source |
| Session recording | Not applicable; Doppler does not broker sessions. | No. SSH session contents are not recorded; Shortspan records that a session was opened and how long the command ran. Listed as coming soon. Source |
| SAML / OIDC single sign-on | SAML SSO from the Team plan; SCIM on Enterprise. Source | Not yet. Sign-in is password plus optional TOTP or passkeys. SAML, OIDC, and SCIM are listed as coming soon. Source |
| Audit log | Activity logs: 3 days on Developer, 90 days on Team, custom retention on Enterprise. Source | Append-only, including refusals, on the Team plan. Records that a credential was released, never its value. Source |
| Approved operational runbooks | Not a Doppler feature. | Versioned runbooks with optional approval before each run. Steps run on the executor’s machine and are not sandboxed. Source |
| Independent compliance report | States SOC 2 and ISO 27001 certification. Source | None yet. Controls are built with SOC 2 in mind, but no audit has been completed. Source |
Every claim on this page - about Shortspan and about the other products - was checked against the linked public source on . Products change; if something here is out of date, tell us at info@shortspan.dev and we will correct it.
Where they differ
Delivering secrets to applications
Both inject secrets into a process as environment variables: doppler run and shortspan run. Doppler goes further for applications - config syncs push secrets to cloud platforms and CI, a Kubernetes operator syncs them into clusters, and rotation is automatic from the Team plan.
Shortspan has none of those integrations. Applications and pipelines reach Shortspan through its CLI or REST API with a scoped token.
Access to infrastructure
Doppler can store an SSH key or a database password, but it does not open the session. Shortspan does: shortspan ssh and shortspan db broker the credential into memory and connect, shortspan aws and shortspan k8s give a subshell its cloud or cluster credentials, and every release is recorded.
Approvals
Doppler’s change requests govern changes to secrets. Shortspan’s access requests govern who may use a project’s resources, for how long: a required reason, a window from one to 72 hours, approval by someone else, and automatic expiry.
Pricing
Doppler charges per user: Developer is free for three users, then $8 per additional user per month; Team is $21 per user per month. Shortspan’s Free plan covers one user, and Team is $49 per month · 5 users included. Which is cheaper depends on team size and on which plan’s features you actually need - compare the current pages before you decide.
Common questions
Doppler or Shortspan?
- Can Shortspan sync secrets to Vercel, GitHub Actions, or AWS like Doppler?
- No. Shortspan has no platform syncs. Pipelines fetch secrets with the CLI or REST API using a scoped token.
- Does Doppler manage SSH or database access?
- Doppler stores those credentials as secrets but does not broker sessions. Shortspan opens the SSH session or database client for you without the developer holding the credential.
- Does Shortspan support SAML SSO?
- Not yet. Sign-in is a password with optional TOTP or passkeys; SAML, OIDC, and SCIM are listed as coming soon. Doppler offers SAML SSO from its Team plan.
Keep comparing
Related comparisons
Try it on one project.
The free plan is enough to register a server and a secret and see whether the workflow fits.