supabase_vault

Supabase Vault Extension

Overview

PackageVersionCategoryLicenseLanguage
pg_vault0.3.1SECApache-2.0C
IDExtensionBinLibLoadCreateTrustRelocSchema
7030supabase_vaultNoYesNoYesNoNovault
Relatedpgsodium passwordcheck_cracklib supautils pg_session_jwt anon pg_tde pgsmcrypto pgaudit

Version

TypeRepoVersionPG VerPackageDeps
EXTPIGSTY0.3.11817161514pg_vaultpgsodium
RPMPIGSTY0.3.11817161514vault_$v-
DEBPIGSTY0.3.11817161514postgresql-$v-vault-
OS / PGPG18PG17PG16PG15PG14
el8.x86_64
el8.aarch64
el9.x86_64
el9.aarch64
el10.x86_64
el10.aarch64
d12.x86_64
d12.aarch64
d13.x86_64
d13.aarch64
u22.x86_64
u22.aarch64
PIGSTY 0.3.1
PIGSTY 0.3.1
PIGSTY 0.3.1
PIGSTY 0.3.1
PIGSTY 0.3.1
u24.x86_64
u24.aarch64
PIGSTY 0.3.1
PIGSTY 0.3.1
PIGSTY 0.3.1
PIGSTY 0.3.1
PIGSTY 0.3.1

Build

You can build the RPM / DEB packages for pg_vault using pig build:

pig build pkg pg_vault         # build RPM / DEB packages

Install

You can install pg_vault directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:

pig repo add pgsql -u          # Add repo and update cache

Install the extension using pig or apt/yum/dnf:

pig install pg_vault;          # Install for current active PG version
pig ext install -y pg_vault -v 18  # PG 18
pig ext install -y pg_vault -v 17  # PG 17
pig ext install -y pg_vault -v 16  # PG 16
pig ext install -y pg_vault -v 15  # PG 15
pig ext install -y pg_vault -v 14  # PG 14
dnf install -y vault_18       # PG 18
dnf install -y vault_17       # PG 17
dnf install -y vault_16       # PG 16
dnf install -y vault_15       # PG 15
dnf install -y vault_14       # PG 14
apt install -y postgresql-18-vault   # PG 18
apt install -y postgresql-17-vault   # PG 17
apt install -y postgresql-16-vault   # PG 16
apt install -y postgresql-15-vault   # PG 15
apt install -y postgresql-14-vault   # PG 14

Create Extension:

CREATE EXTENSION supabase_vault CASCADE;  -- requires: pgsodium

Usage

supabase_vault: Encrypted secret storage for Supabase

Supabase Vault provides a vault.secrets table to store sensitive information (API keys, tokens, etc.) encrypted at rest. Decryption happens on the fly through the vault.decrypted_secrets view.

CREATE EXTENSION supabase_vault CASCADE;

Storing Secrets

INSERT INTO vault.secrets (secret) VALUES ('s3kre3t_k3y') RETURNING *;

-- Or use the helper function:
SELECT vault.create_secret('another_s3kre3t');

-- With optional name and description:
SELECT vault.create_secret('my_secret', 'unique_name', 'This is the description');

Reading Secrets

The vault.secrets table stores data encrypted. Use the vault.decrypted_secrets view to read decrypted values:

SELECT * FROM vault.decrypted_secrets ORDER BY created_at DESC LIMIT 3;
-- Includes a `decrypted_secret` column with the plaintext value

Updating Secrets

SELECT vault.update_secret(
    '7095d222-efe5-4cd5-b5c6-5755b451e223',
    'n3w_upd@ted_s3kret',
    'updated_unique_name',
    'This is the updated description'
);

Security Note

Turn off statement logging to prevent secrets from appearing in logs:

ALTER SYSTEM SET statement_log = 'none';

Last Modified 2026-03-12: add pg extension catalog (95749bf)