Accessing 1Password items from the terminal#

I save things like API keys in 1Password. Today I figured out how to access those from macOS terminal scripts.

My initial goal was to make a Fly.io API key available in an environment variable, without copying and pasting it.

Claude pointed me to the op 1Password terminal app. Here are the official installation instructions, which boil down to:

1
brew install 1password-cli

Then open 1Password and find the Developer tab in settings and enable the 1Password CLI option:

Having done this, the op command is ready to use. To see a list of vaults:

1
op vault list

This asked me for my Touch ID before running:

I only have one vault, so I got back this:

1
ID                            NAME
2
db6xmelzrupwlyrfbiy5ltrnfy    Personal

There are a few ways to access items. One is to find the item ID using op items list and grep:

1
op items list | grep 'Datasette Cloud Dev'

This displayed:

1
uv4maokwxaaymkmoxawwcyfeve    Datasette Cloud Dev Simon     Personal     4 minutes ago

You can then access the item using op item get and that ID:

1
op item get uv4maokwxaaymkmoxawwcyfeve

This output what looked like YAML:

1
ID:          uv4maokwxaaymkmoxawwcyfeve
2
Title:       Datasette Cloud Dev Simon
3
Vault:       Personal (db6xmelzrupwlyrfbiy5ltrnfy)
4
Created:     27 minutes ago
5
Updated:     5 minutes ago by Simon Willison
6
Favorite:    false
7
Version:     2
8
Category:    LOGIN
9
Fields:
10
  username:    fly token
11
  password:    FlyV1 fm2_...

You can also use the direct title of the item, like this:

1
op item get 'Datasette Cloud Dev Simon'

We just want the password, to write into an environment variable. Using --fields password nearly gets us that:

1
op item get 'Datasette Cloud Dev Simon' --fields password

Output:

1
"FlyV1 fm2_..."

This is wrapped in double quotes. The easiest way I found to strip those was to pipe it through jq -r - where the -r tells jq to output the raw value:

1
op item get 'Datasette Cloud Dev Simon' --fields password | jq -r

Output:

1
FlyV1 fm2_...

Then I assigned it to an environment variable like this:

1
export FLY_API_KEY=$(op item get 'Datasette Cloud Dev Simon' --field password | jq -r)

And used that key in an API call like this:

1
curl 'https://api.machines.dev/v1/apps?org_slug=datasette-cloud-dev' \
2
  -H "Authorization: $FLY_API_KEY"

Which output:

1
{"total_apps":0,"apps":[]}