Reading Secrets With the 1Password CLI
Tags: 1password, cli
Published: 2023-09-06 20:15:17

---
title: Reading Secrets With the 1Password CLI
published: true
description: 1Password is a password manager that offers a CLI, allowing for programmatic retrieval of secrets.
tags: 1password, cli
canonical_url: https://odongo.pl/reading-secrets-with-the-1password-cli
---

I use 1Password as my password manager but didn't really see much need for the CLI that they provide until fairly recently. I'll go over a couple of use cases where the CLI has integrated really well into my workflow.

## Keeping Dot Files Password-Free

I've been using `aerc`<sup><a href="#footnote-1" role="doc-noteref" id="ref-1">1</a></sup> for a few weeks. When you add an email account to `aerc`, it saves the password in a configuration file (`~/.config/aerc/accounts.conf` for me), an example of which can be seen below:

```toml
[Fastmail]
source   = imaps://user%40fastmail.com:agvsbg8gd29ybgqh@imap.fastmail.com
outgoing = smtps://user%40fastmail.com:agvsbg8gd29ybgqh@imap.fastmail.com
```

Having the password stored in plain text<sup><a href="#footnote-2" role="doc-noteref" id="ref-2">2</a></sup> is less than ideal, even if it is on a device you own. Helpfully, `aerc` provides a way to specify an arbitrary command that can be executed to retrieve the password. To use the 1Password CLI, the accounts configuration file can be modified as follows:

```toml{3,5}
[Fastmail]
source            = imaps://user%40fastmail.com@imap.fastmail.com
source-cred-cmd   = op read op://MyVault/Fastmail/aerc-password
outgoing          = smtps://user%40fastmail.com@imap.fastmail.com
outgoing-cred-cmd = op read op://MyVault/Fastmail/aerc-password
```

The command we want executed is `op read`, and we pass it the URL<sup><a href="#footnote-3" role="doc-noteref" id="ref-3">3</a></sup> of the secret to access. The next time `aerc` is launched, a TouchID prompt, or a prompt to `Allow Access`, will be presented as shown below:


![Launching aerc with the 1Password CLI integration](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dcpenpzg0rg9m5ybnudp.gif)

## Autofilling One-Time Passwords

As a publisher of npm packages, it's a good idea to enable 2FA on your npm account. This makes a leaked token with write-access less of a risk since no writes (such as publishing a new version of a package) can be performed without a valid OTP.

When publishing an npm package using `npm publish`, a prompt is shown in the terminal asking the user to type in the OTP. However, there is also an `--otp` flag we can make use of to provide the OTP upfront:

```
npm publish --otp $(op item get NPM --otp)
```

This time we use the `op item get` command<sup><a href="#footnote-4" role="doc-noteref" id="ref-4">4</a></sup>, passing it the name of the item and the `--otp` flag. Upon execution, a TouchID prompt or an `Allow Access` prompt is presented, removing the need to manually type or paste the OTP. As an added convenience, the above command can be bound to a shell alias.


![Publishing an npm package with the 1Password CLI integration](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6aoa82sukqs9k86xla7q.gif)

## Footnotes

<ol role="doc-endnotes">
<li id="footnote-1">
<p><a href="https://aerc-mail.org/" rel="nofollow">aerc</a> is a terminal-based email client. <a href="#ref-1" role="doc-backlink">↩︎</a></p>
</li>
<li id="footnote-2">
<p>This <a href="https://gist.github.com/ryanahamilton/2045007" rel="nofollow">helpful URL scheme</a> shows that the password is <code>agvsbg8gd29ybgqh</code>. <a href="#ref-2" role="doc-backlink">↩︎</a></p>
</li>
<li id="footnote-3">
<p>The URL takes the form:</p>
<pre><code>op://&lt;vault&gt;/&lt;item&gt;[/&lt;section&gt;]/&lt;field&gt;</code></pre> <a href="#ref-3" role="doc-backlink">↩︎</a>
</li>
<li id="footnote-4">
<p>Note that if we tried using the <code>op read</code> command:</p>
<pre><code>op read 'op://MyVault/NPM/Security/one-time password'</code></pre>
<p>instead of the current OTP being returned, we would get the reference URL used to generate the OTP:</p>
<pre><code>otpauth://totp/croccifixio?secret=AGVSBG8GD29YBGQHIGDVB2QGBMLNAHQ1&issuer=npm</code></pre>
<a href="#ref-4" role="doc-backlink">↩︎</a>
</li>
</ol>