Skip to main content

AUTHENTICATE A 1PASSWORD VAULT WITH A TOKEN FILE

This guide shows you how to give a 1Password-backed Swamp vault a service account token stored in a file. Swamp passes the token only to the op child process instead of exporting OP_SERVICE_ACCOUNT_TOKEN into the whole shell environment.

Prerequisites

  • A signed-in Swamp account: swamp auth login for interactive use, or SWAMP_API_KEY and SWAMP_SIGNIN_TOKEN set in CI
  • The 1Password CLI (op) installed and on PATH on the machine that runs Swamp
  • A 1Password service account with access to the vault you want to use, here CI

Pull the extension

swamp extension pull @swamp/1password

The output looks like:

INF extension·pull: Pulling "@swamp/1password"@"2026.10.13.1"
INF extension·pull: Identity verified: "@swamp/1password"@"2026.10.13.1"
INF extension·pull: Pulled "@swamp/1password"@"2026.10.13.1"
INF extension·pull: Extracted 6 files:

Write the token to a file

Save the service account token to a file that only the user running Swamp can read, for example /etc/swamp/op-service-account-token. The path you give Swamp must be absolute. On CI runners, write the file from the runner's secret store at the start of the job.

Create the vault

Create a @swamp/1password vault named ci-1password with these settings in its config:

  • op_vault: CI
  • op_service_account_token_file: /etc/swamp/op-service-account-token

The Use 1Password guide shows the swamp vault create command and how to pass --config. If the runner signs in to more than one account, also set op_account. See Use a specific 1Password account for a vault.

Verify access

swamp vault list-keys ci-1password

This runs op with the token read from the file and lists the keys stored in the CI vault. If it fails to authenticate, check that the path is absolute, the file contains only the token, and the user running Swamp can read the file.

Reference secrets from the vault

Behavior definitions read from this vault the same way as from any other:

${{ vault.get('ci-1password', 'deploy-key') }}

Refer to the Vaults reference for the full set of vault commands. To limit which runs can reach ci-1password, see Limit Which Vaults a Run Can Use.