Developers

Hey team,Claude Code just release a new https://code.claude.com/docs/en/remote-control feature that lets you send prompts and commands to your desktop (or remote sandbox) directly from a mobile app. You might already be using itI have a feeling a lot of devs are going to run into the same need for "remote 1Password auth" because of this.I really love how smooth 1Password handles secret and env management. I keep all my dev keys in 1P, and a lot of my scripts are tightly coupled with the op CLI. For pure local development, this setup is flawless.I tossed Claude Code into a local Docker sandbox for security reasons. Whenever it needed a 1Password key (like for git SSH), I just used SSH forwarding to my host machine for biometric auth. That worked fine since I was sitting right there.But this new mobile remote control feature completely breaks that workflow. I'm not at my desk to scan my fingerprint. Sure, we could generate static tokens to let the agent grab what it needs, but that’s way

I'd like to file a feature request and share a use case where the current "domain-only" matching makes day-to-day autofill noticeably worse, and to ask whether path-aware matching could be reconsidered as an opt-in optionUp front: I can see from a quick search that this is clearly a much-requested feature, with threads going back what feels like several presidential administrations. Normally I'd just add a thumbs-up to the canonical request rather than start a new thread - but without a feature-request tracker (more on that at the end), I genuinely couldn't tell which of the many overlapping discussions is the "live" one the team is actually watching, vs. the ones now being slowly reclaimed by the forum equivalent of moss. So I'm posting fresh rather than guessing wrong and shouting into a tomb. Apologies for the duplication; please feel free to merge this into whichever discussion is currently canonical.## The situationI have multiple distinct logins on the same domain, distinguished

Currently local env files can only be mounted via the GUI application. For simplification, allowing an environment to be mounted via the op CLI would allow automating setup of local development environments. e.g.op environment mount "Web Application Environment" .env 

Hi,On KDE Plasma (Wayland), the Quick Access shortcut (Ctrl+Shift+Space) works for some time and then stops. It usually breaks after I restart 1Password or log in again. After that, pressing the shortcut does nothing.I use 1Password 8.12.36 on NixOS 26.11 with KDE Plasma 6.7.5 (xdg-desktop-portal 1.22.1, xdg-desktop-portal-kde 6.7.5, kglobalacceld 6.7.5).I looked at the xdg-desktop-portal-kde log. When the shortcut works, 1Password calls CreateSession, ListShortcuts and then BindShortcuts. When it does not work, 1Password only calls CreateSession and ListShortcuts, and never calls BindShortcuts:xdg-desktop-portal-kde: CreateSession called with parameters:    session_handle: "/org/freedesktop/portal/desktop/session/1_229/com_onepassword_onepassword_global_shortcuts"    app_id: "com.onepassword.OnePassword"xdg-desktop-portal-kde: ListShortcuts called with parameters:    session_handle: "/org/freedesktop/portal/desktop/session/1_229/com_onepassword_onepassword_global_shortcuts" In this st

Hello, I’m integrating 1Password with a product, I’ve hit a limitation, and I think this would be a great feature to have: the ability to save an arbitrary set of fields/values outside of those defined in the “HTML Living Standard” (https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill) as per https://www.1password.dev/web/add-1password-button-websiteThe idea is to not limit what can be saved into 1Password to the website button that triggers the browser extension and allow the creation of a 1Password entry with whatever fields/values the page provides. There are cases when I might want to offer the page viewer to save an arbitrary field.Right now this is not possible if it’s not supported by “autocomplete”.For example, I if I want to offer to save the following fields:“username”: “my_user” “password”: “my_pass” “some”: “value” “other_attribute”: “other_value”The save trigger would only populate the “username” and “password” through the extension and not allo

Description: Currently, 1Password Environments and Vault Items are two completely separate systems with no connection between them. This creates a fundamental problem for professional workflows: Environments provide fast, secure secret delivery via Named Pipes – great for local developmentVault Items provide rotation, audit trails, access control, and CLI management – great for operationsBut you have to choose one or maintain both in parallel, which means either giving up rotation or giving up fast secret delivery.Proposed Solution: Allow an Environment variable to be linked to a Vault Item. The Environment would act as a structured view over Vault Items, not a separate data store.Benefits: Single source of truth – secrets live in Vault Items, Environments just expose themRotation works automatically – rotate the Vault Item, the Environment reflects the change immediatelyAudit trail remains intact – all access and changes tracked in Vault ItemsNamed Pipe delivery stays fast – no c

Today we’re introducing 1Password for NVIDIA OpenShell, available now as a developer preview in the 1Password nightly build. You can set up and connect a 1Password Environment to the OpenShell runtime, which lets your agents work with the systems they need without exposing real credentials to the underlying model.Agentic workflows introduce a fundamental security challenge: credentials. An agent needs access to repositories, APIs, and internal services to complete complex tasks, but a long-lived secret grants broader, more persistent access than necessary. Developers need a way to give agents access only where it’s approved and for as long as it’s needed. How it works 1Password for NVIDIA OpenShell extends 1Password’s secrets management workflow through 1Password Environments. It gives developers a dedicated place to organize the variables an agent needs, separate from personal passwords and shared team credentials. You can map an Environment to an OpenShell Provider Profile, choose th

Hi 1Password team Could you add Ghostty support to Universal Autofill for terminal password prompts on macOS? Today Universal Autofill works for Terminal.app and iTerm2, but not Ghostty. 1Password’s docs say terminal autofill uses macOS Automation and accesses the active terminal session TTY to identify password fields. Ghostty has added the missing pieces on its side:Ghostty 1.3 added AppleScript automation: https://ghostty.org/docs/features/applescript Ghostty PR #11922 adds `pid` and `tty` to the AppleScript terminal class, targeted for Ghostty 1.4.0: https://github.com/ghostty-org/ghostty/pull/11922 Ghostty’s bundle identifier is `com.mitchellh.ghostty`.Once Ghostty 1.4.0 ships, the active terminal should be addressable like this:tell application "Ghostty" set term to focused terminal of selected tab of front window get tty of term input text "..." to termend tellGhostty’s injection command is `input text`, while Terminal.app and iTerm2 expose different AppleScript commands, so

The desktop app is setup with “Integrate with 1Password CLI”CLI access was working prior under MacOS 26.x.x

https://github.com/jqssun/android-titanium-browser

Hello,This feature request comes from a couple of years of daily experience with the 1Password CLI.I use the CLI to populate environment variables during software development, pulling individual line items from secure notes. My biggest pain point is that when I need to find a specific line item within a secure note, there's no way to search within the note in the 1Password desktop app.Some of my secure notes contain up to 50 items, and scanning the full list by eye every time is slow and error-prone.Could you add the ability to search within an item's contents (not just across item titles/fields at the vault level)? Even a simple in-item find/filter would make a big difference for this workflow.Thanks for considering it.

I am trying to use a service account to read secrets from a vault. And it did work for a few tries but now I get the following error message: [ERROR] 2024/08/26 08:10:39 failed to re-initialize service account session - number of retries (1) exceeds max (1) And yes that error message is 1 day old. I have tried to rotate the token and to create a new service account but nothing has changed. I still get the same error. $ op --version 2.30.0 1Password Version: Not Provided Extension Version: Not Provided OS Version: Not Provided Browser: Not Provided

Hello 1Password team,I found a possible timestamp encoding issue when exporting credentials from 1Password through Apple’s Credential Exchange Framework (CXF) to another password manager.Environment:- 1Password: iOS 8.12.36- OS: iOS 27.0 (24A435)- Destination: another password manager using Apple AuthenticationServices and ASCredentialImportManagerSteps:1. Export credentials from 1Password using Apple Credential Exchange.2. Import them into another password manager.3. Inspect the imported item creation and modification dates.Expected behavior:According to the CXF format, creationAt and modifiedAt are Unix timestamps in seconds. The destination should preserve those timestamps.Actual behavior:The batch timestamp is normal, but the per-item timestamps are shifted by approximately 30 years:Batch timestamp:1789134572.928309Item 0:- created.timeIntervalSince1970: 2736400894.0- created.timeIntervalSinceReferenceDate: 1758093694.0- lastModified.timeIntervalSince1970: 2736400923.0- displayed d

Environment- 1Password for Linux 8.12.36, browser extension 8.12.36.40 (stable)- Google Chrome 153.0.8010.36, Ubuntu 22.04- Self-managed GitLab EE 19.3.1- Business account; passkey saved in a Login item (username + passkey + one-time password)ProblemSince the extension updated to 8.12.36 (universal sign-in) on Sept 9, 2026, 1Password no longer handles the passkey on our self-managed GitLab. Both the 2FA page after SAML SSO and the passwordless page (/users/passkeys/sign_in) behave the same way: no "Use passkey" prompt from 1Password. Instead Chrome shows its native "Use a saved passkey for gitlab.example.com" dialog (only "phone or tablet" / "USB security key"), and sign-in fails with NotAllowedError. The universal sign-in prompt at the top of the page only offers password logins.What still works- Passkeys for Google and Cloudflare through 1Password, in the same Chrome profile.- On the same GitLab origin, this minimal call from the DevTools console is answered by 1Password with the cor

Environment: `op` CLI 2.34.1 on Windows 11, Individual account, desktop app integration.`op vault create <name>` succeeds even when a vault with that exact name already exists,creating a second vault silently. There is no `--if-not-exists` flag and no warning on stderr.This breaks the common provisioning pattern of "ensure the vault exists":    op vault create "My Vault"    # expected: no-op, or an error if it exists                                  # actual:   creates a SECOND vault named "My Vault"The failure does not surface at creation time. It surfaces later, in an unrelated command:    [ERROR] More than one vault matches "My Vault". Try again and specify the vault by its ID:      * for the vault "My Vault": 5q4gshqd3zm6rhdeufydesasge      * for the vault "My Vault": zhaytuxho7nbdna6z7mxmvrggmBy then the duplicate already exists and has to be deleted manually from the app.Steps to reproduce:1. op vault create "Test Duplicate"2. op vault create "Test Duplicate"   -- succeeds,

Do you use Claude Code alongside 1Password’s developer tools?We’re writing a blog post about using 1Password’s developer tools with AI coding tools and want to feature community tips, use cases, and anecdotes. For example, do you:Store your Anthropic API key in 1Password and authenticate Claude Code through a 1Password Shell Plugin? Store secrets in a 1Password Environment and make them available through the 1Password CLI? Use Claude Code to make changes, then use the 1Password SSH agent to authenticate Git pushes?Share your setup, favorite workflow, or best tip in the comments. What saved you time? What surprised you? What would you recommend to someone getting started?

As the subject notes, I've noticed 1password locks itself within about 10 seconds regardless of what I've set the auto-lock setting to. This makes copying and grabbing passwords, otp codes etc very difficult as I need to do it within 10 seconds of opening 1password.This has been happening for quite some time (6+ months at least) when I run screen shares with a remote macOS host via the screen share app using High Performance or Dynamic Resolution. The issue does not occur if I change from High Performance to standard in the macOS screen share app. High Performance is useful as it adjusts the remote display to match the display I'm using on my local machine. Which makes needing to switch back to standard -  not ideal.The remote machine display does not scale nicely if in standard screen share type mode.I was wondering if anyone else has seen this issue?Remote Mac is running MacOS 15.6.11password ver. 8.11.6 

Hi all, I'm trying to use 1Password's SSH Bookmarks feature and I'm hitting a wall. I'd like to understand whether bookmarks are supposed to work on their own, or whether the generated config file is actually mandatory in practice. **What I did** Following the docs at https://www.1password.dev/ssh/bookmarks#ssh-bookmarks-config-file: - I added a custom field to my SSH Key item with the value `ssh://mybox`.- In my `~/.ssh/config` I already have a `Host mybox` block pointing at the real hostname/user.- I did **not** enable "Generate SSH config files with bookmarked hosts". **What happens** When I run `ssh -vvv mybox`, the SSH client still asks the 1Password agent for basically every key it manages and tries them one by one, until the server cuts me off with: ```Too many authentication failures``` So the bookmark itself doesn't seem to influence which key gets offered for `mybox`. **What does work** If I enable **Settings → Developer → SSH Agent → Advanced → Generate SSH config files with

Dear 1Password Support Team,I hope this message finds you well. I am a user of 1Password, currently managing SSH keys for secure access to our my Cloud servers. I am reaching out to enquire about a feature regarding SSH key management within 1Password.Issue DescriptionCurrently, when I store an SSH key in a shared vault and add my colleagues into the vault, all fields of the SSH key item, including the private key, become visible to them. This poses a security concern, as I need to grant access for them to use the key for authentication without allowing them to see, copy, or export the private key itself.Let me know if this feature exists in any of your available plans. Thanks,Jay.

ContextI use the 1Password SSH Agent for three things with different trust levels: pulling/pushing git over SSH, signing git commits with an SSH key, and opening interactive SSH sessions to production servers.I also run an AI coding agent (Claude Code) as one of the applications with access to my SSH key. It only ever needs to git pull. It should never sign a commit on my behalf, and it should never open an SSH connection to a server.ProblemThe only control over prompt frequency (Settings → Developer → Advanced → "Ask approval for each new") is one global setting shared by every application. I currently keep it on "application and terminal session" – the strictest option short of "request", per the docs – specifically so that no single app gets standing access. In practice this means opening or resuming a coding session in the desktop app triggers a manual approval click – there's no terminal in the app's own UI; that label is just how 1Password categorizes the shell process running un

Summary: op performs an lstat on ~/Library/Group Containers/2BUA8C4S2C.com.1password/Library/Application Support/1Password/Data/settings/policies.json at startup, apparently checking for enforced enterprise policies. On macOS, App Data Protection treats any access into another app's group container as "op would like to access data from other apps" and prompts. For processes with no application ancestor (launchd jobs, daemon-spawned agents), the grant cannot be persisted, so the prompt appears on EVERY invocation. The probe happens even when OP_SERVICE_ACCOUNT_TOKEN is set and OP_BIOMETRIC_UNLOCK_ENABLED=false — i.e. when the desktop app is irrelevant to the invocation. Environment: op 2.39.0 (Homebrew cask), macOS 26.5.1 (25F80), Apple Silicon, desktop app installed, Individual plan. Steps to reproduce:1. Create a service account and export its token.2. Run "op vault list" from a context with no app ancestor — e.g. a one-shot LaunchAgent with ProgramArguments [/opt/homebrew/bin/op, vau

While the SSH integration works well for local interactions, not every situation supports looking up credentials from a local 1password identity, e.g. accessing git over ssh itself on remote servers. And frequent actions require copying the passphrase oftenopen quick search, open in 1password, manually copy the passphrase custom field, paste, which is immediately purged from the clipboard after repeatIt would be ideal if the passphrase for an SSH key were included in the default keys, and in the fields that can be copied from quick access.

I can't find a guide on how do I integrate 1Password Connect server (that I deployed in kubernetes) with docker compose workload.Something as simple as not hardcoding passwords `POSTGRES_PASSWORD: "op://stuff/pgdb/password"` . I know there are `op run/inject/read` but these are a part of Connect.

Hi, I plan to use 1Password Environments to manage credentials for local development of a Django application running in Docker containers. I want to inject environment variables into those containers at runtime without maintaining a plaintext .env file or baking secrets into images.I understand that macOS and Linux can use a locally mounted .env file with Docker Compose’s env_file support. I am developing on Windows, however, and I do not see the Local .env file option—only AWS Secrets Manager, GitHub Actions, CLI, and SDK workflows.Is there a supported Windows-native way to connect a 1Password Environment directly to Docker Compose? If not, is the recommended approach to use the 1Password CLI to load Environment values before running docker compose up?If so, could you share the current recommended Windows/PowerShell command or workflow—ideally one that makes the same Environment values available to multiple Compose services without writing secrets to disk?As a last-resort workaround,

I want to be able to open and fill from the cli.I have a long history of using password managers, > 1000 passwords for things over the years with some overlap in various imports and consolidations etc. I’d like to generally go through these and cleanup / consolidate / update old passwords, etc. with my coding agent driving the process. But I don’t want the agent to actually look at the passwords, or do anything beyond basic crud / archive etc.I’d like to be able to run something like the following:op item open Netflixorlink=$(op item get Netflix --open-and-fill-link)open “$link” -a Firefox