Do you have an SDK for our language?
- Date
- By
- CipherStash Team
The Stack SDK is TypeScript. It runs on Node 22 and later, and on Deno, Supabase Edge Functions, Cloudflare Workers and Bun through a WebAssembly build. It does not run in the browser. For Go, Python, Ruby or anything else, Proxy sits in front of Postgres and speaks the wire protocol, so your language does not matter.
If your backend is Python, Go, Ruby or .NET and you want an in-process SDK, we do not have one in the docs today, and this note will not promise you a quarter. What you can use now is Proxy. It is a service in your infrastructure that speaks the Postgres wire protocol, so an unchanged application in any language connects to it instead of the database and gets encryption on the way in and decryption on the way out.
The SDK
The Stack SDK is TypeScript. The native build runs on Node 22 or later. A WebAssembly build covers runtimes without native modules, which is how it runs in Deno and Supabase Edge Functions, and the edge skill covers Cloudflare Workers and Bun.
It does not run in the browser, and the docs say so in three places. The SDK holds a client key and talks to ZeroKMS, and neither belongs in a bundle shipped to a user. Keep it on the server.
ORMs and clients
- Drizzle. Encrypted column types and operators that only compile for the capabilities the column has. Targets EQL v3.
- Prisma ORM 8. The integration targets the Prisma ORM 8 release candidate, formerly called Prisma Next. It does not extend the classic Prisma client. On an earlier Prisma, wrap your reads and writes with the SDK instead.
- supabase-js. A wrapper around your existing client that keeps
.eq(),.in(),.gt()and.order()working on encrypted columns. Free-text and JSON queries need Drizzle or Prisma, because PostgREST cannot express their operands. - DynamoDB. A wrapper around the DynamoDB document client that encrypts before a write and decrypts after a read, with equality lookups on an HMAC term.
- Raw pg or postgres.js. Encrypt the value, insert it, cast the query operand. The quickstart uses this path.
- Anything else. Encrypt before write, decrypt after read, with the SDK around your existing data layer.
Next.js
Add the SDK to serverExternalPackages so the native module is not bundled. Routes that use the Prisma adapter cannot select the edge runtime.