postgres/contrib/pg_tde/documentation/docs/how-to/external-parameters.md

# Use External Reference to Parameters

To allow storing secrets or any other parameters in a more secure, external location, `pg_tde`
allows users to specify an external reference instead of hardcoded parameters.

In the Alpha1 version, `pg_tde` supports the following external storage methods:

* `file`, which just stores the data in a simple file specified by a `path`. The file should be
readable to the postgres process.
* `remote`, which uses a HTTP request to retrieve the parameter from the specified `url`.

## Examples

To use the file provider with a file location specified by the `remote` method,
use the following command:

```sql
SELECT pg_tde_add_database_key_provider_file(
    'file-provider', 
    json_object( 'type' VALUE 'remote', 'url' VALUE 'http://localhost:8888/hello' )
    );"
```

Or to use the `file` method, use the following command:

```sql
SELECT pg_tde_add_database_key_provider_file(
    'file-provider', 
    json_object( 'type' VALUE 'remote', 'path' VALUE '/tmp/datafile-location' )
    );"
```

Any parameter specified to the `add_key_provider` function can be a `json_object` instead of the string, similar to the above examples.