supabase_vault

Overview

Upstream 0.3.2/pkg 0.3.1; restrict decrypted view access; keep plaintext out of logs; pgsodium no longer required.

Version

Build

You can build the RPM / DEB packages for pg_vault using pig build:

pig build pkg pg_vault         # build RPM / DEB packages

Install

You can install pg_vault directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:

pig repo add pgsql -u          # Add repo and update cache

Install the extension using pig or apt/yum/dnf:

pig install pg_vault;          # Install for current active PG version

pig ext install -y pg_vault -v 18  # PG 18
pig ext install -y pg_vault -v 17  # PG 17
pig ext install -y pg_vault -v 16  # PG 16
pig ext install -y pg_vault -v 15  # PG 15
pig ext install -y pg_vault -v 14  # PG 14

dnf install -y vault_18       # PG 18
dnf install -y vault_17       # PG 17
dnf install -y vault_16       # PG 16
dnf install -y vault_15       # PG 15
dnf install -y vault_14       # PG 14

apt install -y postgresql-18-vault   # PG 18
apt install -y postgresql-17-vault   # PG 17
apt install -y postgresql-16-vault   # PG 16
apt install -y postgresql-15-vault   # PG 15
apt install -y postgresql-14-vault   # PG 14

Create Extension:

CREATE EXTENSION supabase_vault;

Usage

Sources:

• Official source
• Official source
• Official source
• Official source

supabase_vault 0.3.2 stores encrypted secrets in PostgreSQL and exposes decrypted values through a privileged view. Its fixed schema is vault; the current release no longer requires pgsodium. Upstream tests PostgreSQL 14–19. Install as a superuser; no preload or restart is required.

Core Workflow

The following values are demonstration strings, not real credentials:

CREATE EXTENSION supabase_vault;
SELECT vault.create_secret('example-secret', 'api_token', 'Demo only');
SELECT name, decrypted_secret FROM vault.decrypted_secrets WHERE name = 'api_token';
SELECT vault.update_secret(id, 'replacement-example', 'api_token', 'Rotated demo')
FROM vault.secrets WHERE name = 'api_token';

vault.create_secret returns the secret UUID and accepts optional name and description. vault.update_secret updates a selected UUID. vault.secrets holds encrypted values and metadata; vault.decrypted_secrets exposes plaintext to roles allowed to read it. Restrict both helper and view privileges deliberately.

Security and Upgrade

Version 0.3.2 moves pg_temp to the end of the search path used by secret creation/update helpers. After installing its files, run ALTER EXTENSION supabase_vault UPDATE TO '0.3.2' in each database.

Encryption at rest does not prevent authorized queries from returning plaintext. Secret literals and returned values can appear in database logs, client histories or application telemetry; use the documented secret workflow and configure those systems appropriately. Protect the encryption-key environment and verify backup/restore behavior. Do not treat access to the decrypted view as safe merely because the stored table is encrypted.