Skip to main content

B2 Key

@sntxrr/b2-keyv2026.08.05.3· 1d agoMODELS
01README

Manage a Backblaze B2 application key via the Native API v4 — sync, create, and idempotent delete. The one-shot applicationKey secret is delivered straight to 1Password Connect and never written to a resource snapshot; create fails closed when no destination is configured.

02Release Notes

sync and delete no longer erase where a key's secret was stored. secretDelivered and secretDestination are now properties of the KEY rather than of the run and are carried forward, because a routine read-only sync was overwriting them with false/null and destroying the only durable pointer to the credential — and delete did the same at the moment an orphaned 1Password item most needs finding. Key mint, secret delivery and revoke verified end to end against live B2.

03Models1
@sntxrr/b2/keyv2026.08.05.3b2_key.ts

Global Arguments

ArgumentTypeDescription
applicationKeyIdstringB2 application key ID (master or scoped) used to authenticate this model.
applicationKeystringB2 application key — supply via vault.get(), never inline.
authHost?stringOverride the B2 authorize host (testing only).
accountId?stringB2 account ID. Optional — defaults to the accountId returned by
managedKeyId?stringapplicationKeyId of the B2 key this model manages. Optional — `create`
maxKeyCount?numberPage size for b2_list_keys (B2 default 100, max 10000). Every list call
connectHost?string1Password Connect base URL, e.g. http://connect.example.com:8080.
connectToken?string1Password Connect API token — supply via vault.get(), never inline.
connectVaultId?stringUUID of the Connect-readable 1Password vault that receives the secret.
connectVaultTitle?stringTitle of the 1Password vault, resolved to a UUID when connectVaultId is
connectItemTitle?stringTitle of the 1Password item that receives the key. Created if absent.
connectItemCategorystring1Password category used when this model has to create the item.
connectKeyIdFieldLabelstringLabel of the item field that receives the non-secret applicationKeyId.
connectKeyFieldLabelstringLabel of the item field that receives the one-shot secret. Written as a
connectTimeoutMsnumberAbort any single 1Password Connect call after this long.
fn sync()
Locate the managed key with b2_list_keys and snapshot its metadata.
fn create(keyName: string, capabilities: array, bucketIds?: array, namePrefix?: string, validDurationInSeconds?: number, itemTitle?: string, allowDuplicateName: boolean)
Mint a B2 application key (b2_create_key) and deliver its one-shot secret to 1Password Connect. Refuses to mint when no destination is configured.
ArgumentTypeDescription
keyNamestringName for the new key. B2 allows only letters, numbers and '-', max 100
capabilitiesarrayCapabilities granted to the new key, e.g.
bucketIds?arrayv4 multi-bucket restriction: the new key may access only these buckets.
namePrefix?stringRestrict the key to files whose names start with this prefix. Applies
validDurationInSeconds?numberExpire the key after this many seconds (B2 max 86400000, ~1000 days).
itemTitle?stringOverride globalArgs.connectItemTitle for this run — the 1Password item
allowDuplicateNamebooleanMint even when a key with this keyName already exists. B2 key names are
fn delete()
Revoke the managed B2 application key (b2_delete_key). Idempotent — an already-absent key is success.

Resources

key(infinite)— Metadata snapshot of a B2 application key. Never contains the applicationKey secret
04Previous Versions2
2026.08.05.2

Live-verification fix. bucketIds is now always an array: an account-wide key previously snapshotted null, which disagreed with @sntxrr/b2-account's encoding of the same B2 field and made bucketIds.length === 0 — the natural test for account-wide — throw. BREAKING for readers: if you branch on 'bucketIds == null' to detect an unrestricted key, move to 'bucketIds.length == 0' or you will silently stop detecting them. A stale scalar bucketId now degrades to a one-element array rather than being read as unrestricted.

2026.08.05.1

First release. Manages one Backblaze B2 application key via the Native API v4: sync, create, and idempotent delete. B2 returns the applicationKey secret exactly once, so create delivers it straight to 1Password Connect and fails closed when no destination is configured — a key that cannot be captured must be revoked, not orphaned. The resource snapshot holds metadata only and has no field capable of carrying the secret.

05Stats
A
100 / 100
Downloads
0
Archive size
30.2 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License declared1/1earned
  • Verified public repository2/2earned
06Platforms
07Labels