1password

Read, write, and annotate secrets stored in 1Password using the op CLI. Supports swamp vault annotate and swamp vault inspect for attaching metadata (URL, notes, labels) to secrets.

Prerequisites

• 1Password CLI installed and in PATH
• Authenticated via one of:
  • Service account: export OP_SERVICE_ACCOUNT_TOKEN=<token>
  • Desktop app: enable CLI integration in 1Password settings
  • Connect Server: export OP_CONNECT_HOST=<url> and export OP_CONNECT_TOKEN=<token>

Usage

swamp vault create @swamp/1password my-1password \
  --config '{"op_vault": "Private"}' --json

swamp vault get my-1password my-api-key --json
swamp vault put my-1password my-api-key "s3cr3t" --json
swamp vault list-keys my-1password --json

Secret Key Format

• item-name — reads the password field of the named item
• item-name/field — reads a specific field
• op://vault/item/field — full 1Password URI (passthrough)