Skip to main content

STORE SECRETS IN SPECIFIC 1PASSWORD ITEM FIELDS

This guide shows you how to keep related values, such as a database username and password, as fields of one 1Password item, and how to address each field from Swamp.

The @swamp/1password vault accepts three key formats:

  • item-name: the password field of the named item
  • item-name/field: a specific field of the named item
  • op://vault/item/field: a full 1Password URI, passed through unchanged

Prerequisites

  • A signed-in Swamp account and an authenticated op CLI
  • The @swamp/1password extension pulled into the repository
  • A Swamp vault named my-1password backed by the Private 1Password vault (see Getting started with 1Password vaults in Swamp)

Write the password

swamp vault put my-1password db-credentials example-password

This writes example-password to the password field of the db-credentials item in Private.

Write a named field

swamp vault put my-1password db-credentials/username app_user

This writes app_user to the username field of the same db-credentials item. Repeat with other field names, such as db-credentials/host, to add more values to the item.

Check the stored keys

swamp vault list-keys my-1password

This lists the keys in my-1password, read from Private through op, so you can confirm both writes landed.

Reference each field

In a behavior definition, use the same key format you wrote with:

  • Username: ${{ vault.get('my-1password', 'db-credentials/username') }}
  • Password: ${{ vault.get('my-1password', 'db-credentials') }}

If you need to read from a 1Password vault other than the one set in op_vault, use a full URI. Swamp passes it to op unchanged:

${{ vault.get('my-1password', 'op://Private/db-credentials/username') }}

To attach a URL, notes or labels to an item, use swamp vault annotate. Refer to the Vaults reference for its options.