Skip to main content

USE A SPECIFIC 1PASSWORD ACCOUNT FOR A VAULT

This guide shows you how to pin each Swamp vault to one 1Password account when the op CLI on a machine is signed in to several, for example a work account and a personal account.

Prerequisites

  • A signed-in Swamp account
  • The op CLI installed, on PATH, and signed in to every account you want to use
  • The shorthand or UUID of each account, as op knows it

Pull the extension

swamp extension pull @swamp/1password

The output looks like:

INF extension·pull: Pulling "@swamp/1password"@"2026.10.13.1"
INF extension·pull: Identity verified: "@swamp/1password"@"2026.10.13.1"
INF extension·pull: Pulled "@swamp/1password"@"2026.10.13.1"
INF extension·pull: Extracted 6 files:

Create one vault per account

Create a separate @swamp/1password vault for each account and set op_account alongside op_vault. op_account takes the account shorthand or UUID.

  • work-1password: op_vault set to Engineering, op_account set to acme.1password.com
  • personal-1password: op_vault set to Private, op_account set to my.1password.com

The Use 1Password guide shows the swamp vault create command and how to pass these settings with --config. If you leave out op_account, the vault uses whichever account op picks by default.

Confirm the work vault

swamp vault list-keys work-1password

This lists the keys in the Engineering vault of the acme.1password.com account. If you see keys from your personal account, check the op_account value against the accounts op is signed in to. Run the same command against personal-1password to check the second vault.

Reference secrets by vault

The Swamp vault name decides which account a secret comes from:

  • ${{ vault.get('work-1password', 'deploy-key') }}
  • ${{ vault.get('personal-1password', 'deploy-key') }}

On a shared server, you can keep runs from reaching the personal vault with the steps in Limit Which Vaults a Run Can Use.