KeyHippo PostgreSQL Extension

KeyHippo extends Supabase's Row Level Security (RLS) to support API key authentication and Role-Based Access Control (RBAC) directly in Postgres.

Installation

Install the KeyHippo extension in your PostgreSQL database:

select dbdev.install('keyhippo@keyhippo');
create extension "keyhippo@keyhippo" version '1.2.0';

KeyHippo enables secure API key management directly in Postgres. Each API key is hashed for storage, ensuring plaintext keys are never exposed.

With KeyHippo, session tokens and API keys can coexist under unified RLS policies, simplifying authentication logic.

Define fine-grained access control through groups, roles, and permissions that integrate seamlessly with your database.

Administrators can impersonate users for troubleshooting or support tasks without compromising security.

Generate an API key for an authenticated user:

SELECT * FROM keyhippo.create_api_key('Primary API Key', 'default');

Revoke an API key:

SELECT keyhippo.revoke_api_key('<api_key_id>');

Rotate an API key (revoke the old one, create a new one):

SELECT * FROM keyhippo.rotate_api_key('<old_api_key_id>');

Full usage details can be found on GitHub.

KeyHippo integrates with Supabase and PostgREST, enabling API key and RBAC functionality within your existing stack.

Hashed Keys: Only key hashes are stored, ensuring plaintext keys are unavailable after creation.
Scoped Permissions: API keys include scoping to restrict their usage.
Session Interoperability: Works alongside session-based authentication.

Contributions are welcome. See our Contributing Guide for details.

KeyHippo is distributed under the MIT license. See the LICENSE file for more information.

For technical issues, open a GitHub issue. For commercial support, visit keyhippo.com.