Package: 1password
OnePassword python clientPython client around the 1Password password manager cli for usage within python code and
Jupyter Notebooks. Developed by Data Scientists from Jamf.Supported versionsThere are some of the pre-requisites that are needed to use the library. We automatically install the cli for Mac and
Linux users when installing the library. Windows users see below for help.1Password App: 8+1Password cli: 2+Python: 3.10+Operating systemsThe library is split into two parts: installation and client in which we are slowly updating to cover as many operating
systems as possible the following table should ensure users understand what this library can and can't do at time of
install.MacOSLinuxFully supportedYYCLI installYYSSO loginYYLogin via AppYYBiometrics authYYPassword authYYCLI clientYYService accountYYInstallationpipinstall1passwordIf you have issues with PyYaml or other distutils installed packages then use:pipinstall--ignore-installed1passwordYou are welcome to install and manageopyourself by visitingthe CLI1 downloads pageto download the version you require
and follow instructions for your platform as long as it's major version 2.The above commands pip commands will checkopis present already and if not will install the supportedopcli
plus the python client itself.
This is currently fixed atopversion 1.12.5 to ensure compatibility. If you wish to use a higher version ofopyou
can by followingthis guide,
however note that we cannot ensure it will work with our client yet.MacOS users will be prompted with a separate installation window to ensure you have a signed version ofop- make
sure to check other desktops that the installer might pop up on.Optional pre-requisitesbase32This utility is used to create a unique guid for your device but this isn't a hard requirement from AgileBits
and so if you seebase32: command not foundan empty string will be used instead,
and the client will still work fully.If you really want to, you can make sure you have this installed by installing coreutils. Details per platform can
be found here:https://command-not-found.com/base32Basic UsageSince v2 of the cli it is advised to connect your CLI to the local app installed on the device, thus removing the need
for secret keys and passwords in the terminal or shell. Read here on how to do that:https://developer.1password.com/docs/cli/get-started#step-2-turn-on-the-1password-desktop-app-integrationAn added extra for Mac users is that you can also enable TouchID for the app and by linking your cli with the app you
will get biometric login for both.Once this is done any initial usage of the cli, and our client will request you to authenticate either via the app or
using your biometrics and then you can continue.We are sure there are use cases where the app cannot be linked and hence a password etc is till required so this
functionality is still present from our v1 implementation and can be described belowPassword authenticationOn first usage users will be asked for both the enrolled email, secret key and password.
There is also verification of your account domain and name.For all following usages you will only be asked for a password.You will be given 3 attempts and then pointed to reset password documentation or alternatively you can
restart your kernel.No passwords are stored in memory without encryption.If you have 2FA turned on for your 1Password account the client will ask for your six digit authenticator code.fromonepasswordimportOnePasswordimportjsonop=OnePassword()# List all vaultsjson.loads(op.list_vaults())# List all items in a vault, default is Privateop.list_items()# Get all fields, one field or more fields for an item with uuid="example"op.get_item(uuid="example")op.get_item(uuid="example",fields="username")op.get_item(uuid="example",fields=["username","password"])Service AccountsWe also support authentication using Service accounts, however these are not interchangeable with other auth routes and
hence other accounts i.e. this token based authentication will take precedence over any other method.
If you wish to use multiple account types, for now you will need to design this workflow yourself
by clearing out the OP_SERVICE_ACCOUNT_TOKEN usingunset OP_SERVICE_ACCOUNT_TOKENbefore re-authenticating with
your preferred account.To use a service account make sure to fulfil the requirements here:https://developer.1password.com/docs/service-accounts/use-with-1password-cliand note that not all of the CLI commands are supported at this time.Also note that your service account will only have access to certain vaults. In particular it will not be able to see
theSharedorPrivatevaults in any account. In our client this means you must always use thevaultoption.Once you have fulfilled all the requirements, namelyexport OP_SERVICE_ACCOUNT_TOKEN=<your token>, you can then use
our client with:fromonepasswordimportOnePasswordop=OnePassword()op.list_vaults()Input formatsTo be sure what you are using is of the right formatEnrolled email: standard email format e.g.user@example.comSecret key: provided by 1Password e.g. ##-######-######-#####-#####-#####-#####Account domain: domain that you would login to 1Password via browser e.g. example.1password.comAccount name: subdomain or account name that cli can use for multiple account holders e.g. exampleContributingThe GitHub action will run a full build, test and release on any push.
If this is to the main branch then this will release to public PyPi and bump the patch version.For a major or minor branch update your new branch should include this new version and this should be verified by the
code owners.In general, this means when contributing you should create a feature branch off of the main branch and without
manually bumping the version you can focus on development.CLI coverageFull op documentation can be found here:https://support.1password.com/command-line-reference/The below is correct as of version 0.3.0.CommandsThis is the set of commands the current python SDK covers:create: Create an objectdocumentdelete: Remove an objectitem: we use this method to remove documents but now there is a new delete document methodget: Get details about an objectdocumentitemlist: List objects and eventsitemsvaultssignin: Sign in to a 1Password accountsignout: Sign out of a 1Password accountThis is what still needs developing due to new functionality being released:add: Grant access to groups or vaultsgroupusercompletion: Generate shell completion informationconfirm: Confirm a usercreate: Create an objectgroupuseritemvaultdelete: Remove an objectdocumentuservaultgrouptrashedit: Edit an objectdocumentgroupitemuservaultencode: Encode the JSON needed to create an itemforget: Remove a 1Password account from this deviceget: Get details about an objectaccountgrouptemplatetotpuservaultlist: List objects and eventsdocumentseventsgroupstemplatesusersreactivate: Reactivate a suspended userremove: Revoke access to groups or vaultssuspend: Suspend a userupdate: Check for and download updatesRoadmapAdd Windows functionalityAdd clean uninstall of client and opRemove subprocess usage everywhere -> use pexpectAdd test docker imageGet full UT coverageAlign response types into JSON / lists instead of JSON stringsEnsure full and matching functionality of CLI in pythonaddconfirmcreatedeleteeditencodeforgetgetlistreactivateremovesuspend