Ideally, you could have a Postgres instance specifically dedicated for secrets - I don't see why you should couple sensitive and non-sensitive data. Many OSS services like HashiCorp Vault just do that: you give Vault a backend (which can be a Postgre DB, just like the one Supabase is offering) and it's gonna use that to save the secrets.
You could then use (e.g.) OpenID to connect to the specific instance of Supabase with those secrets from your application
You could then use (e.g.) OpenID to connect to the specific instance of Supabase with those secrets from your application