Vault

Vault keeps secrets such as API tokens encrypted inside your own database, so SQL, cron jobs and database functions can use them without the plaintext appearing in your schema or backups.

Coming soon: Vault: encrypted secrets in your database is being built

Vault: encrypted secrets in your database is not available on the platform yet. This page describes how it works at launch; prices and plan limits are already published in Platform pricing and limits and nothing is billed before it is live.

Status changes are announced in the changelog; the platform overview lists where every capability stands.

How it works (at launch)

• Secrets are stored encrypted with vault.create_secret(...) and read through the vault.decrypted_secrets view, compatible with Supabase’s supabase_vault.
• The portal lists secrets by name and description, creates, rotates and deletes them; values are write-only there.
• Access to the decrypted view is limited to the roles you grant.

SQL

select vault.create_secret('sk_live_...', 'stripe_key', 'Stripe API key for the billing sync');
select decrypted_secret from vault.decrypted_secrets where name = 'stripe_key';