Supabase Vault

Summary

Supabase Vault is a Postgres extension for managing secrets and encryption inside the database, presented as a thin usability layer over pgsodium. The announcement contrasts it with pgcrypto, which accepts raw encryption keys directly and lacks public key signing, key derivation APIs, and streaming encryption. Vault stores secrets in an encrypted text column, while a unique per-database root key is managed outside SQL by pgsodium and libsodium; rows expose an internally derived key ID rather than the raw key. The vault.decrypted_secrets view decrypts values on demand, leaving stored data encrypted on disk and in backups, and users can create additional keys with pgsodium.create_key(). Vault uses Authenticated Encryption with Associated Data, binding the associated column to the authentication signature, and is positioned for API keys, access tokens, and environment variables rather than larger PII datasets.

Takeaways

1. 1

   The raw encryption key is not exposed in SQL: vault.secrets stores an internally derived key_id, while pgsodium manages the root key through Server Key Management.

2. 2

   vault.decrypted_secrets decrypts values on the fly, so secrets remain encrypted on disk and in backups while still being available through the view.

3. 3

   Vault uses Authenticated Encryption with Associated Data, combining the associated column with the encrypted text’s authentication signature so that associated data can be verified as authentic.