A high-security secret management integration that replaces local storage with an encrypted Supabase Postgres vault for Openclaw Skills.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install supabase-vault
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install supabase-vault using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Supabase Vault?
Supabase Vault is a specialized integration designed to upgrade the security posture of your Openclaw Skills. It replaces the default local secrets.json file with a robust, encrypted-at-rest storage solution powered by Supabase and Postgres. By utilizing pgsodium and libsodium for AES-256 encryption, this skill ensures that sensitive API keys and authentication tokens are never stored in plaintext on your local file system.
In addition to database-level security, this skill implements sophisticated bootstrap credential management. It leverages hardware-backed security on macOS via Keychain Access and utilizes GNOME Keyring or machine-derived AES-256-GCM encryption on Linux and headless environments. This multi-layered approach ensures that even the credentials required to access the vault are protected with industry-standard protocols.
Supabase Vault Use Cases
- Transitioning from plaintext local secret files to a secure, enterprise-grade encrypted database.
- Centralizing credential management for multiple Openclaw Skills across different development environments.
- Implementing hardware-backed security for sensitive API keys on macOS and Linux systems.
- Managing and rotating secrets directly through a dedicated dashboard UI instead of manual JSON editing.
How Supabase Vault Works
- The Openclaw gateway initializes and triggers the fetch-secrets execution provider.
- The system retrieves the Supabase connection string and service role key from the local OS keychain or encrypted configuration file.
- The skill uses the official Supabase JS client to authenticate and call secure RPC functions in the remote database.
- Requested secrets are decrypted in the Supabase Vault and returned over an authenticated connection.
- Secrets are populated directly into the Openclaw runtime memory, ensuring they never reside on disk in a decrypted state.
Supabase Vault Setup
1. Install Dependencies
npm install --prefix ~/.openclaw/skills/supabase-vault @supabase/supabase-js
2. Database Configuration
Execute the assets/setup.sql script within your Supabase SQL Editor to provision the required insert_secret, read_secret, and list_secret_names functions.
3. Gateway Integration
Register the gateway RPC handler in your source code:
import { createSupabaseVaultHandlers } from "./supabase-vault.js";
Object.assign(handlers, createSupabaseVaultHandlers());
4. Build and Restart
cd ~/openclaw && npm run build
systemctl --user restart openclaw-gateway
5. Finalize via Dashboard
Navigate to the Integrations tab in the UI, enter your Supabase Project URL and service_role key, and click Connect.
Supabase Vault Data Schema & Taxonomy
Security Architecture
This skill manages data across local and remote layers to ensure maximum protection for your Openclaw Skills.
| Component | Storage Type | Security Mechanism |
|---|---|---|
| Vault Secrets | Supabase Postgres | AES-256-GCM via pgsodium |
| Bootstrap Keys | OS Keychain / Local | Hardware-backed or machine-derived AES-256 |
| Runtime Secrets | Memory Only | No decrypted data persists on disk |
| Migration Logs | Local | Keeps secrets.json as a temporary safety backup |
Supabase Vault Advanced Features
- Hardware-backed credential storage on Apple Silicon via the security CLI.
- Automated migration tools to transition existing Openclaw Skills from file-based storage to the vault.
- Zero-external-dependency fallback using PBKDF2-HMAC-SHA512 for headless or WSL2 environments.
- Integrated dashboard UI for real-time secret CRUD operations and connectivity testing.
SKILL.md
Loading
Related Openclaw Skills
Skill Creator
A specialized framework for designing, initializing, and packaging modular capabilities for AI agents.
Serper Search Skill
A high-performance, cost-effective Google Search API integration for programmatic data retrieval and lead generation.
React Local Business Website Generator
A specialized skill for generating production-ready, 5-page React websites for local businesses with modern animations and responsive design.
Plugin Architecture
A specialized framework extension that enables plugins to register and display custom UI views and sidebar tabs within the Control dashboard.
Website Auditor
An automated auditing tool that evaluates website quality across 8 technical signals to identify outdated, broken, or neglected web properties.
Zapier MCP
A powerful integration skill that connects AI agents to over 8,000 applications through the Model Context Protocol without complex OAuth management.
Featured*
