How we encrypted OIDC refresh tokens in PostgreSQL for WikiMind
At WikiMind, we ran into the classic pain point: refresh tokens shouldn’t just be stored as “well, they’re there.” We encrypted them with `pgcrypto` directly in PostgreSQL and wrapped that in custom SQLAlchemy types.
At WikiMind, we ran into the classic pain point: refresh tokens shouldn’t be stored as “well, they’re there” but properly. We set up encryption with pgcrypto directly in PostgreSQL and wrapped it in custom SQLAlchemy types — from the application’s point of view, it’s transparent: write a token, read a token, no manual crypto scattered through the codebase.
The trade-off is straightforward: decryption happens in the database, so PostgreSQL takes on extra CPU load. But in return, the application code is cleaner, and we get at-rest protection with no ambiguity.
Given the recent discussions around supply chain security and zero trust, this is no longer “paranoia” — it’s just good hygiene. Like 2FA: before it bites you, it feels unnecessary; afterward, you’re glad you did it 😅
Sometimes the best engineering move is not the flashiest one, but the one that removes risk without hurting DX.