1password

1Password CLI

Use op CLI to manage passwords and API credentials in the 1Password vault.

Prerequisite Check

Before use, confirm that op is installed and integrated with the desktop app:

op --version

If not installed, guide the installation:

brew install --cask 1password-cli

After installation, enable the integration in the 1Password desktop app: Settings → Developer → Integrate with 1Password CLI.

Save API Credential

When the user provides API Key information, use the following command to save it. Fill in fields according to what is actually provided, and omit fields that are not provided.

Title naming convention: {服务商} API Key - {用途标识}(e.g., OpenAI API Key - agent）

op item create \
  --category="API Credential" \
  --title="{标题}" \
  --vault="Personal" \
  "credential={API Key}" \
  "website[url]={网站 URL}" \
  "base_url[text]={API base URL}" \
  "username[text]={邮箱或用户名}" \
  "用途说明[text]={用途描述}" \
  "过期时间[text]={YYYY-MM-DD}" \
  "创建日期[text]={YYYY-MM-DD}" \
  --tags "{服务商},{项目标签}"

Minimum required field: credential(the API Key itself). Fill in the remaining fields according to what the user provides.

Query/Search Items

Fuzzy search by title or URL keyword:

op item list --format=json | python3 -c "
import json, sys
items = json.load(sys.stdin)
keyword = '{关键词}'.lower()
for i in items:
    title_match = keyword in i['title'].lower()
    url_match = any(keyword in str(u) for u in i.get('urls', []))
    if title_match or url_match:
        print('ID:', i['id'], '| Title:', i['title'], '| Updated:', i.get('updated_at', ''))
"

Read Credential

# 读取（隐藏值）
op item get "{标题}" --fields credential

# 读取（显示明文）
op item get "{标题}" --fields credential --reveal

Inject Environment Variables (Development Workflow)

In the .env file, use Secret References instead of plaintext, so it can be safely committed to git:

OPENAI_API_KEY=op://Personal/OpenAI API Key - agent/credential
DEEPSEEK_API_KEY=op://Personal/DeepSeek API Key - agent skd/credential

Inject real values when running the script:

op run --env-file=.env -- your-script.sh
op run --env-file=.env -- python3 main.py

Vault Management

# 查看所有 vault
op vault list

# 查看某 vault 下所有条目
op item list --vault="Personal"

# 按 tag 筛选
op item list --tags "deepseek"

Workflow Example

When the user says "Help me save OpenAI's API Key: sk-xxx":

Confirm that op is installed and available
Collect information: service provider name, API Key, website URL, purpose, associated project (according to what the user provides)
Execute op item create to save
Output the save result (ID, title, field list), without displaying the credential plaintext