supabase_vault

pg_vault : Supabase Vault Extension

Overview

Packages

Source

pig build pkg pg_vault;		# build rpm/deb

Install

Make sure PGDG and PIGSTY repo available:

pig repo add pgsql -u   # add both repo and update cache

Install this extension with pig:

pig install pg_vault;		# install via package name, for the active PG version
pig install supabase_vault;		# install by extension name, for the current active PG version

pig install supabase_vault -v 18;   # install for PG 18
pig install supabase_vault -v 17;   # install for PG 17
pig install supabase_vault -v 16;   # install for PG 16
pig install supabase_vault -v 15;   # install for PG 15
pig install supabase_vault -v 14;   # install for PG 14

Create this extension with:

CREATE EXTENSION supabase_vault;

Usage

Sources:

• Official source
• Official source
• Official source
• Official source

supabase_vault 0.3.2 stores encrypted secrets in PostgreSQL and exposes decrypted values through a privileged view. Its fixed schema is vault; the current release no longer requires pgsodium. Upstream tests PostgreSQL 14–19. Install as a superuser; no preload or restart is required.

Core Workflow

The following values are demonstration strings, not real credentials:

CREATE EXTENSION supabase_vault;
SELECT vault.create_secret('example-secret', 'api_token', 'Demo only');
SELECT name, decrypted_secret FROM vault.decrypted_secrets WHERE name = 'api_token';
SELECT vault.update_secret(id, 'replacement-example', 'api_token', 'Rotated demo')
FROM vault.secrets WHERE name = 'api_token';

vault.create_secret returns the secret UUID and accepts optional name and description. vault.update_secret updates a selected UUID. vault.secrets holds encrypted values and metadata; vault.decrypted_secrets exposes plaintext to roles allowed to read it. Restrict both helper and view privileges deliberately.

Security and Upgrade

Version 0.3.2 moves pg_temp to the end of the search path used by secret creation/update helpers. After installing its files, run ALTER EXTENSION supabase_vault UPDATE TO '0.3.2' in each database.

Encryption at rest does not prevent authorized queries from returning plaintext. Secret literals and returned values can appear in database logs, client histories or application telemetry; use the documented secret workflow and configure those systems appropriately. Protect the encryption-key environment and verify backup/restore behavior. Do not treat access to the decrypted view as safe merely because the stored table is encrypted.