1password

Read, write, delete, and annotate secrets stored in 1Password using the op CLI. Supports swamp vault delete for removing secrets and swamp vault annotate and swamp vault inspect for attaching metadata (URL, notes, labels) to secrets. Emits OpenTelemetry spans for vault operations and per-CLI-invocation child spans so failures and latency are attributable in traces when a TracerProvider is configured. Reads retry briefly by default when an item another process just created is not visible yet (read_retry_attempts, read_retry_seconds).

Prerequisites

• 1Password CLI installed and in PATH
• Authenticated via one of:
  • Service account: export OP_SERVICE_ACCOUNT_TOKEN=<token>, or set op_service_account_token_file in the vault config to read the token from a file and pass it only to the op child process
  • Desktop app: enable CLI integration in 1Password settings
  • Connect Server: export OP_CONNECT_HOST=<url> and export OP_CONNECT_TOKEN=<token>

Usage

swamp vault create @swamp/1password my-1password \
  --config '{"op_vault": "Private"}' --json

swamp vault get my-1password my-api-key --json
swamp vault put my-1password my-api-key "s3cr3t" --json
swamp vault list-keys my-1password --json

Secret Key Format

• item-name — reads the password field of the named item
• item-name/field — reads a specific field
• op://vault/item/field — full 1Password URI (passthrough)