How We Encrypt OIDC Refresh Tokens Directly in PostgreSQL
At WikiMind, we encrypt OIDC refresh tokens in PostgreSQL using pgcrypto and hide it behind custom SQLAlchemy types, so the application sees a transparent interface with no magic in the services.
At WikiMind, we built something that saves us from a lot of unnecessary pain in the code: we encrypt OIDC refresh tokens with pgcrypto directly in PostgreSQL. On top of that, we wrote custom SQLAlchemy types so the application sees a transparent interface: save it — it gets encrypted, read it — it gets decrypted. No magic in every service and no “oops, we forgot to protect a secret here.”
The trade-off is straightforward: decryption on the database side consumes PostgreSQL CPU. But in return, we significantly simplify the application and get at-rest protection out of the box. In an era when secret leaks and supply-chain incidents are back at the top of the discussion, this kind of protection is no longer a “nice to have” — it’s the baseline.
In short: a bit more load on the database, but a lot less chaos in the code and a calmer team 😌