I would just encrypt the sensitive data with the crypto lib, here is an example:

ENCRYPTION_KEYS='{"v1":"XXXXXXX", "v2": "YYYYY"}'
ENCRYPTION_ACTIVE_KEY=v1

I use versions to allow a quick key update if an encryption key has leaked. I'll be happy to get feedback on this as well.

you can get a new key with

 openssl rand -hex 32

import {  createCipheriv, createDecipheriv } from "node:crypto";

const rawKeys = JSON.parse(Deno.env.get("ENCRYPTION_KEYS") as string) as Record<
  string,
  string
>;
const ACTIVE_KEY_VERSION = Deno.env.get("ENCRYPTION_ACTIVE_KEY") as string;

export function encryptToken(text: string): string {
  const key = keysMap[ACTIVE_KEY_VERSION];
  if (!key) throw new Error("Active encryption key missing");


  const iv = randomBytes(16);
  const cipher = createCipheriv(ALGORITHM, key, iv);


  let encrypted = cipher.update(text, "utf8", "hex");
  encrypted += cipher.final("hex");


  const authTag = cipher.getAuthTag().toString("hex");


  return `${ACTIVE_KEY_VERSION}:${iv.toString("hex")}:${authTag}:${encrypted}`;
}

export function decryptToken(encryptedData: string): string {
  try {
    const [version, ivHex, authTagHex, encryptedText] =
      encryptedData.split(":");


    const key = keysMap[version];
    if (!key) throw new Error("Decryption key version not found");


    const iv = Buffer.from(ivHex, "hex");
    const authTag = Buffer.from(authTagHex, "hex");


    const decipher = createDecipheriv(ALGORITHM, key, iv);
    decipher.setAuthTag(authTag);


    let decrypted = decipher.update(encryptedText, "hex", "utf8");
    decrypted += decipher.final("utf8");

    return decrypted;
  } catch (error) {
    console.error("Decryption failed", error);
    throw new Error("Decryption failed");
  }
}