alexai-mcp/hermes-ccc/one-password

# Install 1Password CLI (op)
# macOS
brew install 1password-cli
 
# Linux
curl -sS https://downloads.1password.com/linux/keys/1password.asc | gpg --import
# See: developer.1password.com/docs/cli/get-started
 
# Windows
winget install AgileBits.1Password.CLI
 
# Verify
op --version

# Sign in (opens browser or prompts)
op signin
 
# Or with service account (CI/CD)
export OP_SERVICE_ACCOUNT_TOKEN="eyJhbGci..."
 
# Check auth
op whoami

# Read a field from an item
op item get "AWS Credentials" --field "access key id"
op item get "GitHub Token" --field password
 
# Read by item ID
op item get "abc123xyz" --field password
 
# Read as env var format
op item get "AWS Credentials" --format json

# op run: inject secrets into any command
op run --env-file=".env.1password" -- python my_script.py
 
# .env.1password format:
# AWS_ACCESS_KEY_ID=op://Private/AWS Credentials/access key id
# AWS_SECRET_ACCESS_KEY=op://Private/AWS Credentials/secret access key
# DATABASE_URL=op://Work/Production DB/connection string

op://VAULT/ITEM/FIELD
op://Private/GitHub/token
op://Work/AWS Production/access key id

export GITHUB_TOKEN=$(op item get "GitHub" --field token)
export DB_PASS=$(op item get "PostgreSQL Prod" --field password)

import subprocess
def get_secret(vault, item, field):
    result = subprocess.run(
        ["op", "item", "get", item, "--vault", vault, "--field", field],
        capture_output=True, text=True, check=True
    )
    return result.stdout.strip()
db_password = get_secret("Work", "PostgreSQL Prod", "password")
api_key = get_secret("Private", "OpenAI", "api key")

# List all vaults
op vault list
 
# List items in vault
op item list --vault Private
 
# Search
op item list --categories Login --tags production

# Create a login
op item create \
  --category Login \
  --title "My Service" \
  --vault Work \
  username="admin" \
  password="$(openssl rand -base64 32)"
 
# Create an API credential
op item create \
  --category "API Credential" \
  --title "OpenAI" \
  credential="sk-..."

# GitHub Actions
- name: Configure 1Password
  uses: 1password/load-secrets-action@v2
  with:
    export-env: true
  env:
    OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
    AWS_ACCESS_KEY_ID: op://CI/AWS/access-key-id
    AWS_SECRET_ACCESS_KEY: op://CI/AWS/secret-access-key

# 1Password SSH Agent (stores SSH keys in 1Password)
# Enable in 1Password Settings → Developer → SSH Agent
 
# Use in ~/.ssh/config:
Host github.com
  IdentityAgent "~/Library/Group Containers/.../agent.sock"
 
# List SSH keys
op item list --categories "SSH Key"