1Password Plugin

@theholocron/holocron-plugin-1password vault

npm · GitHub

Install

pnpm add -D @theholocron/holocron-plugin-1password

Capabilities

Capability	Token
vault	op CLI session (biometric on laptop; OP_SERVICE_ACCOUNT_TOKEN in CI)

The op CLI must be installed separately. Install it from 1password.com/downloads/command-line or via Homebrew:

brew install --cask 1password/tap/1password-cli

Config

providers: {
  vault: ["1password", {
    // Required: 1Password vault name where items live
    vault: "acme-app",
    // Optional: 1P account UUID (--account flag on every op call)
    account: "ABCDEFGHIJKLMNOPQRSTUVWXYZ",
  }],
}

Options

Option	Required	Description
vault	Yes	1Password vault name
account	No	1Password account UUID — useful when multiple accounts are signed in

Authentication

On laptop: Sign in via the 1Password desktop app or op signin. The plugin uses the active session automatically.

In CI: Create a service account token and set it in your workflow:

1. Go to my.1password.com/developer-tools/service-accounts
2. Click New Service Account, name it (e.g. “CI”), and grant access to the vaults the plugin needs
3. Copy the token (shown once) and store it as a repository secret named OP_SERVICE_ACCOUNT_TOKEN

env:
  OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

holocron auth set 1password does not store a token — it prints the AUTH_HINT instead.

Secret reference format

1Password item references follow the format op://Vault/Item/field:

# Read a secret
op://acme-app/database/password

In the vault capability this format is used with vault.read(reference).

What vault provides

• read(reference) — reads a secret by op://Vault/Item/field reference
• write(reference, value) — writes a secret value
• list() — lists available secret references in the configured vault
• readEnvironment?(id) — reads all KEY=VALUE pairs from a 1Password Environment item (supports holocron secrets sync)
• ensureProject?(name) — creates the top-level vault container if missing
• ensureEnvironment?(project, name) — creates an environment item inside a project