1password

Read, write, delete, and annotate secrets stored in 1Password using the op CLI. Supports swamp vault delete for removing secrets and swamp vault annotate and swamp vault inspect for attaching metadata (URL, notes, labels) to secrets. Emits OpenTelemetry spans for vault operations and per-CLI-invocation child spans so failures and latency are attributable in traces when a TracerProvider is configured.

Prerequisites

• 1Password CLI installed and in PATH
• Authenticated via one of:
  • Service account: export OP_SERVICE_ACCOUNT_TOKEN=<token>
  • Desktop app: enable CLI integration in 1Password settings
  • Connect Server: export OP_CONNECT_HOST=<url> and export OP_CONNECT_TOKEN=<token>

Usage

swamp vault create @swamp/1password my-1password \
  --config '{"op_vault": "Private"}' --json

swamp vault get my-1password my-api-key --json
swamp vault put my-1password my-api-key "s3cr3t" --json
swamp vault list-keys my-1password --json

Secret Key Format

• item-name — reads the password field of the named item
• item-name/field — reads a specific field
• op://vault/item/field — full 1Password URI (passthrough)