DEV Community

Emmanuel Odongo
Emmanuel Odongo

Posted on • Updated on • Originally published at

Reading Secrets With the 1Password CLI

I use 1Password as my password manager but didn't really see much need for the CLI that they provide until fairly recently. I'll go over a couple of use cases where the CLI has integrated really well into my workflow.

Keeping Dot Files Password-Free

I've been using aerc1 for a few weeks. When you add an email account to aerc, it saves the password in a configuration file (~/.config/aerc/accounts.conf for me), an example of which can be seen below:

source   = imaps://
outgoing = smtps://
Enter fullscreen mode Exit fullscreen mode

Having the password stored in plain text2 is less than ideal, even if it is on a device you own. Helpfully, aerc provides a way to specify an arbitrary command that can be executed to retrieve the password. To use the 1Password CLI, the accounts configuration file can be modified as follows:

source            = imaps://
source-cred-cmd   = op read op://MyVault/Fastmail/aerc-password
outgoing          = smtps://
outgoing-cred-cmd = op read op://MyVault/Fastmail/aerc-password
Enter fullscreen mode Exit fullscreen mode

The command we want executed is op read, and we pass it the URL3 of the secret to access. The next time aerc is launched, a TouchID prompt, or a prompt to Allow Access, will be presented as shown below:

Launching aerc with the 1Password CLI integration

Autofilling One-Time Passwords

As a publisher of npm packages, it's a good idea to enable 2FA on your npm account. This makes a leaked token with write-access less of a risk since no writes (such as publishing a new version of a package) can be performed without a valid OTP.

When publishing an npm package using npm publish, a prompt is shown in the terminal asking the user to type in the OTP. However, there is also an --otp flag we can make use of to provide the OTP upfront:

npm publish --otp $(op item get NPM --otp)
Enter fullscreen mode Exit fullscreen mode

This time we use the op item get command4, passing it the name of the item and the --otp flag. Upon execution, a TouchID prompt or an Allow Access prompt is presented, removing the need to manually type or paste the OTP. As an added convenience, the above command can be bound to a shell alias.

Publishing an npm package with the 1Password CLI integration


  1. aerc is a terminal-based email client. ↩︎

  2. This helpful URL scheme shows that the password is agvsbg8gd29ybgqh. ↩︎

  3. The URL takes the form:

  4. Note that if we tried using the op read command:

    op read 'op://MyVault/NPM/Security/one-time password'

    instead of the current OTP being returned, we would get the reference URL used to generate the OTP:


Top comments (0)