Protect what matters – even after you're gone. Make a plan for your digital legacy today.
Forum Discussion
XIII
4 years agoSuper Contributor
[13] Can the 1Password CLI replace dotenv (on Raspberry Pi)?
On my Raspberry Pi I use dotenv to store some credentials, but I don't feel comfortable storing credentials in plain text on the SD card of that machine.
Would I be able to use the 1Password CLI i...
1P_Simon
1Password Team
4 years agoHi XIII, I'm sorry about the slow reply.
The idea we have for service accounts is that automated use cases such as (web) applications, CI/CD pipelines and other services that run without human intervention would run as themselves - as the service - instead of using a humans account to log in.
Just like human accounts, they'd have a couple things:
- You can grant and revoke the service access to vault(s); So you'd be able to limit access for the service to just the secrets it needs, following the https://blog.1password.com/guiding-principles-how-least-privilege-leads-to-more-security/.
- You can identify the service in https://blog.1password.com/introducing-events-api/, so you'd be able to pin down which service (app, CI pipeline etc.) had that activity.
What would be different is how you authenticate the service. A human logs in to 1Password using their secret key and account password (or with the https://1password.community/discussion/126766/biometric-unlock-is-here) and is prompted for re-authentication after 30 minutes of inactivity or 12 hours in total. A service authenticates using a credential. It's build to run without human intervention and there's no need to re-authenticate. You'd set this credential for example in an environment variable and once that's done, the service will run until you'd revoke it.
That said, I'd love to hear more about your needs and use case and what you'd like this feature to look like. We're here to listen and learn and make sure what we're building achieves your goals.