Developer secrets management
Manage application secrets without passing them around.
Shortspan gives engineering teams one encrypted workspace for application secrets and the operational resources that use them. Developers request or use what they are allowed to use from the CLI, while administrators keep ownership, access policy, and history in the console.
Why teams change
A shared secret should not become a copied secret.
Secrets spread when the easiest delivery path is chat, email, a shared document, or a local .env file. Every copy creates another place to rotate, another device to trust, and another trail that is hard to reconstruct during an incident.
Shortspan stores secret values in an encrypted workspace, scopes them to projects, and lets teams group related values for a workload. The CLI can inject an approved group into a child process so everyday development does not depend on exposing values in the console or copying them into source-controlled files.
What Shortspan adds
Control around the workflow, not another workflow beside it.
Encrypted, project-scoped storage
Keep API keys, tokens, connection strings, certificates, and environment values inside a workspace and project boundary instead of scattering them across devices.
Use secrets from the CLI
Inject a named secret group into a command at runtime. The application receives environment variables without requiring a permanent plaintext file on the developer machine.
Permissions and history
Separate the right to manage, reveal, and use sensitive values. Record security-relevant actions so access reviews have an attributable timeline.
The workflow
From registered resource to accountable use.
- 01
Organize secrets by project
Register the values a service or environment needs and bundle related entries into a named secret group.
- 02
Grant the smallest useful access
Use workspace roles, project membership, and temporary grants to decide who may use or administer each resource.
- 03
Run the workload
Use the group from the Shortspan CLI and keep the resulting access event available for later review.
Operational outcomes
Make the secure path the understandable path.
- Fewer credentials copied into chat, tickets, and local files
- One workflow for individual developers and engineering teams
- Clear project boundaries for development, staging, and production
- A reviewable history of sensitive actions
Common questions
Know where the boundary is.
- Is Shortspan a password manager?
- No. It is designed for developer and operations workflows: project-scoped application secrets, CLI injection, infrastructure connections, temporary access requests, runbooks, and audit history.
- Does the CLI write secrets to a .env file?
- The run workflow injects approved values into a child process environment. It does not require a permanent plaintext .env file for that workflow.
- Can access and credential rotation be handled separately?
- Yes. Revoking a Shortspan grant removes the right to request or use a resource through Shortspan. Rotating an underlying database password, cloud key, or third-party token remains a separate source-system operation unless that source supports a rotation workflow you have configured.
Read the implementation details
Documentation for this workflow
Related solutions
Connect the next part of the workflow
Start with one project and one access problem.
Create a workspace free, or tell us what your team needs to broker, approve, and review.