8

Get started with 1Password CLI

 2 years ago
source link: https://developer.1password.com/docs/cli/get-started/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

Get started with 1Password CLI

Requirements

  • Windows
  • Linux

Supported shells: Bash, Zsh, sh, fish

*Required to integrate 1Password CLI with the 1Password app.

Install

  • Windows
  • Linux

You can install 1Password CLI from one of the following packages for your Linux distribution:

  • Alpine
  1. Add the key for the 1Password Apt repository:

    curl -sS https://downloads.1password.com/linux/keys/1password.asc | \
    sudo gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg
  2. Add the 1Password Apt repository:

    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] https://downloads.1password.com/linux/debian/$(dpkg --print-architecture) stable main" |
    sudo tee /etc/apt/sources.list.d/1password.list
  3. Add the debsig-verify policy:

    sudo mkdir -p /etc/debsig/policies/AC2D62742012EA22/
    curl -sS https://downloads.1password.com/linux/debian/debsig/1password.pol | \
    sudo tee /etc/debsig/policies/AC2D62742012EA22/1password.pol
    sudo mkdir -p /usr/share/debsig/keyrings/AC2D62742012EA22
    curl -sS https://downloads.1password.com/linux/keys/1password.asc | \
    sudo gpg --dearmor --output /usr/share/debsig/keyrings/AC2D62742012EA22/debsig.gpg
  4. Install 1Password CLI:

    sudo apt update && sudo apt install 1password-cli
  5. Check that 1Password CLI was installed successfully:

    op --version

Alternatively, download the latest 1Password CLI .deb package directly from one of the following links:

Beta builds

To download 1Password CLI beta builds, navigate to our downloads page and select "Show betas". On Linux, you can switch the channel from "stable" to "beta" when adding the 1Password repository in your package manager.

Sign in

1Password CLI integrates with the 1Password 8 desktop app so you can sign in on the command line with the accounts you've added to the 1Password app. Then you can authenticate your accounts with your fingerprint, face, Windows Hello PIN, Apple Watch, or device user password.

If you don't want to use 1Password CLI with the 1Password desktop app, or if you're using 1Password 7, learn how to sign in to your 1Password account manually instead.

  • Windows
  • Linux

If you downloaded 1Password CLI directly, rather than using the .deb or .rpm installers, do the following:

  • Create the onepassword-cli group if it doesn't yet exist:

    sudo groupadd onepassword-cli
  • Set the correct permissions on the op binary:

    sudo chown root:onepassword-cli /usr/local/bin/op && \
    sudo chmod g+s /usr/local/bin/op

Step 1: Turn on system authentication

To authenticate 1Password CLI with biometrics or your device user password, turn on system authentication in the 1Password 8 desktop app:

  1. Open and unlock the app.
  2. Click your account or collection at the top of the sidebar.
  3. Navigate to Settings > Security.
  4. Select "Unlock using system authentication service".

You'll be prompted to unlock 1Password CLI the same way you sign in to your Linux user account. To change to a different authentication method, adjust your system settings.

The 1Password security pane with the Windows Hello option selected.

Step 2: Connect 1Password CLI with the 1Password desktop app

To sign in to 1Password CLI with the accounts you've added to the 1Password desktop app, navigate to Settings > Developer and select "Connect with 1Password CLI".

The 1Password Developer settings pane with the Connect with 1Password CLI option selected.

Step 3: Sign in to your account

Enter op signin to select an account to sign in to. Use the arrow keys to select an account, then hit enter. You'll be prompted to authenticate.

To sign in to a different account, enter op signin again. You can also specify an account to sign in to with the --account flag or by setting the OP_ACCOUNT environment variable.

A Linux terminal showing the op signin interactive dialogue with the prompt to authenticate with your fingerprint.

Usage

op [command] <flags>

1Password CLI uses a noun-verb command structure that groups commands by topic rather than by operation.

The basic structure of a command starts with the 1Password program op, then the command name (noun), often followed by a subcommand (verb), then flags (which include additional information that gets passed to the command).

For example, to retrieve a list of all the items in your Private vault:

op item list --vault Private

To get a list of all global commands and flags, run the following: ​

op --help

​ And to see the subcommands available for each command, use: ​

op [command] --help

Basic commands

You can use 1Password CLI to work with items, users, vaults, and secrets.

Items

To get information about an item:

op item get <item name>

You'll see the item's ID, title, vault, when it was created, when it was last modified, the item's version, if it's marked as a favorite, the type of item it is, and the item's fields.

If an item name includes spaces or special characters, enclose it in quotes. For example:

op item get "work email"
See result...
ID: a5w3is43ohs25qonzajrqaqx4q
Title: work email
Vault: Work (2gq6v6vzorl7jfxdurns4hl66e)
Created: 6 years ago
Updated: 9 months ago by Wendy Appleseed
Favorite: true
Version: 1
Category: LOGIN
Fields:
password: NLuXcEtg27JMjGmiBHXZMGCgce
URLs:
website: https://www.gmail.com (primary)

To use op item get to retrieve specific fields, include the --fields flag followed by a comma-separated list, with the prefix label= before each field name. For example, to only retrieve the username and password for the item work email:

op item get "work email" --fields label=username,label=password
See result...
[email protected],NLuXcEtg27JMjGmiBHXZMGCgce

Learn more about working with items.

Users and groups

To get details about a user:

op user get "Wendy Appleseed"
See result...
ID: SPRXJFTDHTA2DDTPE5F7DA64RQ
Name: Wendy Appleseed
State: ACTIVE
Type: MEMBER
Created: 6 years ago
Updated: 4 months ago
Last Authentication: 1 month ago

To list the users who belong to a group:

op group user list "Provision Managers"
See result...
ID NAME EMAIL STATE TYPE ROLE
7YEOODASGJE6VAEIOHYWGP33II Wendy Appleseed [email protected] ACTIVE MEMBER
UKCYFVOJSFEXLKKZREG7M2MZWM Johnny Appleseed [email protected] RECOVERY_STARTED MEMBER

Learn more about working with users and groups.

Vaults

To create a new vault named Test:

op vault create Test

To get details about an existing vault:

op vault get Work
See result...
ID: jAeq2tfunmifZfG4WkuWvsaGGj
Name: Work
Type: USER_CREATED
Attribute version: 3
Content version: 241
Items: 25
Created: 1 year ago
Updated: 1 month ago

To list the vaults in an account:

op vault list
See result...
ID NAME
vw8qjYEvsdCcZoULJRCqopy7Rv Development
2RNjh43dpHB9sDqZXEHiiw7zTe Personal
cGxbZbV2pxKBmVJe9oWja4K8km Work

Learn more about working with vaults.

Secrets

To insert a secret into an environment variable, config file, or script without putting the plaintext secret in code, use a secret reference that specifies where the secret is stored in your 1Password account:

op://vault-name/item-name/[section-name/]field-name

Then, you can use op read, op run, or op inject to replace the secret reference with the actual secret at runtime.

To resolve a secret reference and confirm it outputs correctly:

op read "op://Work/work email/username"
See result...

Learn more about loading secrets.

Read the full reference documentation to learn about more advanced use cases.

Unique identifiers (IDs)

When you retrieve information about objects using the get and list subcommands, you'll see a string of numbers and letters that make up the objects's unique identifier (ID).

You can use names or IDs in commands that take any account, user, vault, or item as an argument.

IDs never change, so you can be sure you’re always referring to the same object. Commands provided with an ID are also faster and more efficient.

To get the ID for the item Netflix:

op item get Netflix
See result...
ID: t2Vz6kMDjByzEAcq6peKnHL4k3
Title: Netflix
Vault: Private (sdfsdf7werjgdf8gdfgjdfgkj)
Created: 6 months ago
Updated: 1 month ago by Wendy Appleseed
Favorite: false
Version: 1
Category: LOGIN

To get the IDs for all vaults in an account:

op vault list
See result...
ID NAME
cfqtakqiutfhiewomztljx4woy Development
rr3ggvrlr6opoete23q7c22ahi Personal
2gq6v6vzorl7jfxdurns4hl66e Work

Shell completion

You can add shell completion so that 1Password CLI automatically completes your commands.

With shell completion enabled, start typing an op command, then press Tab to see the available commands and options.

  • PowerShell

To enable shell completion with Bash:

  1. Install the bash-completion package

  2. Add this line to your .bashrc file:

    source <(op completion bash)

Learn more about shell completion.

Next steps

1Password CLI can be used to accomplish many different tasks. Explore the guides below to learn about common use cases.

Read the reference documentation to discover all the possibilities.

Work with items

Manage users

Provision secrets

Pass secrets from 1Password to your applications, scripts and other workloads.

Secure your workflows


Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK