Comparison
Shortspan vs Teleport
Both put a control point between developers and infrastructure. Teleport replaces credentials with short-lived certificates and proxies every session. Shortspan brokers the credentials you already have and stays out of the traffic.
The short answer
Teleport is the more complete access platform: certificates instead of stored keys, session recording, SSO, RDP, and a SOC 2 report. Shortspan is lighter: nothing to install on your servers and no proxy in the path, and it also stores your application secrets and runs approved runbooks - but it records no session contents and has no SSO yet.
Choose Teleport if
- You want no long-lived SSH keys or database passwords at all, replaced by short-lived certificates.
- You need session recording and playback.
- You need RDP, web application, or cloud console access as well as SSH, Kubernetes, and databases.
- You need SAML or OIDC single sign-on (Teleport Enterprise).
- You need a vendor with a SOC 2 Type II report.
Choose Shortspan if
- You want to start without installing agents, configuring a certificate authority, or running a proxy.
- You want application secrets and .env values in the same tool as server and database access.
- You want approval-gated runbooks for deploys and routine operations.
- You are a small team that wants a published price - Team is $49 per month · 5 users included - rather than a quote.
Side by side
Teleport and Shortspan, capability by capability.
| Capability | Teleport | Shortspan |
|---|---|---|
| Primary job | Identity-based infrastructure access: SSH, RDP, Kubernetes, databases, web apps, and cloud APIs through one proxy, with short-lived certificates. Source | One broker for application secrets and infrastructure access (SSH, databases, AWS, Kubernetes), used from a single CLI. |
| How it runs | Teleport Enterprise Cloud (managed) or self-hosted Enterprise and Community Edition. Access runs through the Teleport Proxy Service. Source | Hosted service. Self-hosting is listed as coming soon for Enterprise. Source |
| Source code and licence | Source on GitHub under AGPLv3. Since Teleport 16, Community Edition binaries use a commercial licence: free for companies under 100 employees and US$10M revenue. Source | Proprietary. The source code is not public. |
| Pricing | Enterprise is quoted, priced on active users and protected resources. Community Edition is free within its licence limits. Source | Free for one user. Pro $12 per month. Team $49 per month · 5 users included. Enterprise is quoted. |
| Application secrets | Not a store for application secrets such as API keys or .env values. Its model is short-lived certificates instead of stored credentials. | Encrypted, versioned, project-scoped secrets with typed templates and named groups injected into a process with |
| Credentials generated per request | Yes. Users and machines receive short-lived certificates for each resource instead of long-lived keys or passwords. Source | No. Stored credentials are released for a short-lived grant; the credential itself stays valid until you rotate it. Dynamic credentials are listed as coming soon. Source |
| SSH server access | Through a Teleport agent, or agentless for OpenSSH servers configured to trust Teleport’s CA. The proxy terminates each session to record and audit it. Source | Brokers the stored key or password into the CLI’s memory for one session. Nothing is installed on the server, and traffic does not pass through Shortspan. Per-server host-key pinning, exec, and port-forwarding policy. Source |
| Database access | Broad database support through the proxy. Community Edition excludes Oracle. Source | PostgreSQL and MySQL. Connects directly, through a registered SSH bastion, or by running the client on the server. Source |
| Kubernetes access | Kubernetes access through the proxy with short-lived credentials, in every edition. Source | Releases a stored kubeconfig to a temporary file for one subshell and removes it on exit. Source |
| AWS access | AWS, Azure, and GCP console, API, and CLI access in every edition. Source | Releases stored AWS access keys into one subshell’s environment; nothing is written to ~/.aws. It does not mint temporary STS credentials. Source |
| Access requests with approval | Just-in-time access requests and reviews in Enterprise. Community Edition can only request roles through the CLI. Source | Yes, on the Team plan. A required reason, a 1–72 hour window, approval by someone else, and automatic expiry. Source |
| Session recording | Session recording with playback, and enhanced session recording, in every edition. Source | No. SSH session contents are not recorded; Shortspan records that a session was opened and how long the command ran. Listed as coming soon. Source |
| SAML / OIDC single sign-on | Enterprise: SAML, OIDC, Okta, Entra ID, Google Workspace, and more. Community Edition: GitHub only. Source | Not yet. Sign-in is password plus optional TOTP or passkeys. SAML, OIDC, and SCIM are listed as coming soon. Source |
| Audit log | Structured audit logs with export to a SIEM, in every edition. Source | Append-only, including refusals, on the Team plan. Records that a credential was released, never its value. Source |
| Approved operational runbooks | Not a Teleport feature. | Versioned runbooks with optional approval before each run. Steps run on the executor’s machine and are not sandboxed. Source |
| Independent compliance report | Annual SOC 2 Type II audit; reports through Teleport’s trust portal. Source | None yet. Controls are built with SOC 2 in mind, but no audit has been completed. Source |
Every claim on this page - about Shortspan and about the other products - was checked against the linked public source on . Products change; if something here is out of date, tell us at info@shortspan.dev and we will correct it.
Where they differ
Certificates versus brokered credentials
Teleport issues short-lived certificates to users and machines, so there is no standing SSH key or database password to steal. Servers trust Teleport’s certificate authority - through the Teleport agent, or agentless for OpenSSH.
Shortspan stores the key or password you already use, encrypted, and releases it into the CLI’s memory for one authorized, recorded session. That needs no change on the server, but the underlying credential is long-lived until you rotate it. Teleport’s model is stronger; Shortspan’s is faster to adopt.
In the path, or out of it
Teleport’s proxy terminates each session, which is what makes session recording, moderation, and fine-grained audit possible - and makes the proxy part of every connection.
Shortspan is not in the path. The CLI connects directly, or through an SSH bastion you registered. That means Shortspan cannot record what happened inside a session: it records that a credential was released and how long the command ran, not the commands typed.
Secrets and runbooks
Teleport is not an application secrets store. Shortspan stores typed, versioned secrets and injects named groups into a process with shortspan run, and it runs versioned runbooks that can require approval before each execution.
Editions and licensing
Teleport’s source is AGPLv3. Since Teleport 16, Community Edition binaries are free for companies under 100 employees and US$10M in revenue; Community Edition has GitHub-only SSO and requests roles through the CLI only. Enterprise is priced on active users and protected resources.
Shortspan is proprietary and hosted, with published plans. Access requests are on the Team plan and the audit log on Team; SSO and session recording are listed as coming soon.
Common questions
Teleport or Shortspan?
- Does Shortspan record SSH sessions like Teleport?
- No. Shortspan is not a proxy, so it never sees session contents. It records each credential release, refusals included, and the start and end of each CLI command.
- Do I need to install anything on my servers to use Shortspan?
- No. Shortspan uses the SSH key or password the server already accepts. Optional per-server policy - host-key pinning, whether non-interactive exec or port forwarding is allowed - is enforced by the CLI.
- Is Teleport Community Edition free?
- For individuals, and for companies with fewer than 100 employees and less than US$10M in annual revenue, under Teleport’s Community Edition licence. Larger companies need a commercial agreement. The source code remains available under AGPLv3.
Keep comparing
Related comparisons
Try it on one project.
The free plan is enough to register a server and a secret and see whether the workflow fits.