Feature Request: Remote approval for op CLI / desktop prompts to support Agentic Workflows

Hi @Gregory ,

thanks for writing in, this is a great idea and I'll pass it along to the team!  If more comes to mind, please do pass it along, we highly value feedback!

All the best,
Phil

ref: CFP-19201

Clearly this is a must have, 1password is currently really hard to use in the whole agentic world where things do not live locally anymore. We are investigate other tools to avoid putting secrets in cleartext in agentic environment.

I strongly strongly strongly support this request.  1Password prompting me to unlock it so Claude can sign my git commits using the SSH Agent is the only thing that stops me from starting a task with Claude Code and working from my phone.  Please prioritize this high!

I completely agree and truly hope that 1Password will soon finish developing this feature.

I would love this feature. I was using Krypton (krypt.co) to unlock SSH Keys on my phone long time ago, which could be a similar idea. Looks like it was acquired by Akamai (https://techdocs.akamai.com/mfa/docs/akr-fido2-ssh-agent).

+1 for CFP-19201. I use Codex Remote from my phone to control development work running on my Mac. My SSH keys are managed by the local 1Password SSH Agent, but authorization prompts remain on the Mac and cannot be approved from the 1Password mobile app. This can block SSH reconnects and Git/SSH operations while I am away from the computer. A mobile push approval flow showing the requesting device or app, SSH key, destination, and short-lived Approve/Deny options would solve this without exporting personal keys or disabling approval. Please add my use case and vote to CFP-19201.

+1

So the request, concretely. Two things would each solve it on their own:

1. Per-request approval for the CLI that works off the requesting machine —
   the same shape as Agentic Autofill, but for `op read` / `op run` instead of a
   browser fill. The agent requests a specific item reference, I approve on a
   device I am actually holding, and the value reaches the requester over your
   encrypted channel without a third party in the middle.
2. Approval on a second device for prompts raised on the first, which is
   what this thread originally asked for. Even without remote CLI support, this
   fixes the case where I am simply not at my desk.

Two details that would decide whether it is usable for this:

- Context in the prompt. Agentic Autofill already shows which item is being
  requested. For a CLI request, the command and the working directory would make
  the difference between an informed approval and a reflex. Without it I am
  confirming that something wants a credential, which is not the same as knowing
  what I am agreeing to.
- No approval caching, or caching I can turn off per item. For credentials
  used a few times a month, an approval window is a small version of the
  standing access I am trying to avoid. Per-use is the point.

Adding our use case: AI agent infrastructure with blind CLI prompts

We run Hermes Agent — an open-source AI agent framework — on Linux desktops with 1Password managing all credentials. Multiple background services (Discord bots, web dashboards, inference gateways) resolve op:// secret references at startup via op read.

The blind prompt problem hits us on every service restart. Here's what our users see:

1Password Access Requested Allow /home/user/.hermes/hermes-agent/.hermes-runtime/python/generation-1785278974-417978-f7893c30/cpython-3.11.15-linux-x86_64-gnu/bin/python3.11 to get CLI access [Cancel] [Authorize]

That path is a bundled Python runtime. No human can tell what it is, what secret it's reading, or why. And authorizing grants full vault access — not just the one item being requested.

What we need in the prompt

1. Which item is being requested — "Ollama API Key", not just "Binary Ranch vault"
2. What the process is — "Hermes Agent (Discord gateway)" not a 120-character Python path
3. Why it needs access — "starting up and needs the inference API key to respond to messages"
4. What scope authorizing grants — "This will allow the process to read any item in the Binary Ranch vault" (currently undisclosed)

What we did as a workaround

We built a desktop notification layer in Hermes that fires before op read — so the user sees what's being accessed and why before the 1Password prompt appears. It's open source: PR #104531

But this is a band-aid. The real fix is 1Password showing item-level context in the CLI authorization dialog. We're asking for the same thing others on this thread have asked for: informed consent, not blind authorization.

+1 for CFP-19201. Please prioritize this — the agentic workflow space is growing fast and every developer running background services with op CLI hits this wall.

I have a Claude Code agent that I use basically like a GrokBot or Muse agent - it has its own dedicated machine, browser access, and connections to my email, etc. I often have it perform simple tasks for me like booking a haircut. Unfortunately, at present, I must first log into the target website (using the 1Password browser extension) manually before my agent can then use the authenticated session to complete the assigned task on my behalf. I would *love* for my Claude Code agent to be able to a) see a list of accounts in my 1Password vault and 2) allow for Claude Code to generate a request to use a password which I would approve or reject from the 1Password app on my phone. 

We strongly support this request and urgently need this feature as well.
We already make extensive use of the 1Password SSH Agent for secure LLM agent workflows. Keeping private keys protected while allowing agents to perform explicitly authorized operations is central to our setup.
Being able to approve requests remotely through the 1Password mobile app—including SSH Agent authorization prompts—would make a huge difference. We need to keep human approval in the loop even when we are away from the machine running the agent.
Please add our vote to CFP-19201 and prioritize this feature.