B2 Key
Manage a Backblaze B2 application key via the Native API v4 — sync, create, and idempotent delete. The one-shot applicationKey secret is delivered straight to 1Password Connect and never written to a resource snapshot; create fails closed when no destination is configured.
sync and delete no longer erase where a key's secret was stored. secretDelivered and secretDestination are now properties of the KEY rather than of the run and are carried forward, because a routine read-only sync was overwriting them with false/null and destroying the only durable pointer to the credential — and delete did the same at the moment an orphaned 1Password item most needs finding. Key mint, secret delivery and revoke verified end to end against live B2.
Global Arguments
| Argument | Type | Description |
|---|---|---|
| applicationKeyId | string | B2 application key ID (master or scoped) used to authenticate this model. |
| applicationKey | string | B2 application key — supply via vault.get(), never inline. |
| authHost? | string | Override the B2 authorize host (testing only). |
| accountId? | string | B2 account ID. Optional — defaults to the accountId returned by |
| managedKeyId? | string | applicationKeyId of the B2 key this model manages. Optional — `create` |
| maxKeyCount? | number | Page size for b2_list_keys (B2 default 100, max 10000). Every list call |
| connectHost? | string | 1Password Connect base URL, e.g. http://connect.example.com:8080. |
| connectToken? | string | 1Password Connect API token — supply via vault.get(), never inline. |
| connectVaultId? | string | UUID of the Connect-readable 1Password vault that receives the secret. |
| connectVaultTitle? | string | Title of the 1Password vault, resolved to a UUID when connectVaultId is |
| connectItemTitle? | string | Title of the 1Password item that receives the key. Created if absent. |
| connectItemCategory | string | 1Password category used when this model has to create the item. |
| connectKeyIdFieldLabel | string | Label of the item field that receives the non-secret applicationKeyId. |
| connectKeyFieldLabel | string | Label of the item field that receives the one-shot secret. Written as a |
| connectTimeoutMs | number | Abort any single 1Password Connect call after this long. |
| Argument | Type | Description |
|---|---|---|
| keyName | string | Name for the new key. B2 allows only letters, numbers and '-', max 100 |
| capabilities | array | Capabilities granted to the new key, e.g. |
| bucketIds? | array | v4 multi-bucket restriction: the new key may access only these buckets. |
| namePrefix? | string | Restrict the key to files whose names start with this prefix. Applies |
| validDurationInSeconds? | number | Expire the key after this many seconds (B2 max 86400000, ~1000 days). |
| itemTitle? | string | Override globalArgs.connectItemTitle for this run — the 1Password item |
| allowDuplicateName | boolean | Mint even when a key with this keyName already exists. B2 key names are |
Resources
Live-verification fix. bucketIds is now always an array: an account-wide key previously snapshotted null, which disagreed with @sntxrr/b2-account's encoding of the same B2 field and made bucketIds.length === 0 — the natural test for account-wide — throw. BREAKING for readers: if you branch on 'bucketIds == null' to detect an unrestricted key, move to 'bucketIds.length == 0' or you will silently stop detecting them. A stale scalar bucketId now degrades to a one-element array rather than being read as unrestricted.
First release. Manages one Backblaze B2 application key via the Native API v4: sync, create, and idempotent delete. B2 returns the applicationKey secret exactly once, so create delivers it straight to 1Password Connect and fails closed when no destination is configured — a key that cannot be captured must be revoked, not orphaned. The resource snapshot holds metadata only and has no field capable of carrying the secret.
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned