Getting started with 1Password for your growing team, or refining your setup? Our Secured Success quickstart guide is for you.
Forum Discussion
sisk
5 months agoNew Contributor
Feature request: select account in `op://` url querystring
Hi there! Had a feature request I'd like to make. I have several environment variables with 1Password secret paths across a couple of accounts, some of which are in my environment only when my work...
1P_Phil
Moderator
2 months agoQuick update, one of our devs kindly reminded me of the "--account" flag on the CLI which is way better than "op login". This should get you the functionality you need for scripting.
op read --account account1 op://secret/in/account1
op read --account account2 op://secret/in/account2
Thanks,
Phil
sisk
2 months agoNew Contributor
Hi 1P_Phil,
Thanks for the reply. Unfortunately, the `--account` flag is insufficient for this purpose.
The issue arises when using `op run` to replace secret references in the environment that span multiple accounts with their contents.
For example:
My environment has secrets from a mix of different 1Password accounts depending on which directory I'm working out of. Some are shared secrets managed by my employer, some are personal secrets managed in my personal account. So, at any given time, my environment may have something like the following:
$ env
PERSONAL_API_TOKEN="op://Private/Some Service I Pay For/credential"
WORK_MANAGED_PERSONAL_API_TOKEN="op://Employee/Some Service My Company Pays For Me/credential"
WORK_MANAGED_SHARED_API_TOKEN="op://Department/Some Service My Company Pays For A Department/credential"
The first env var (`PERSONAL_API_TOKEN`) is in the 1p account I pay for outside of my employer. The other two are in the account my employer manages.
At this point, there does not appear to be an `op run` incantation that will allow all of these secrets to resolve correctly. Depending on which account is default (or which account I specify with the `--account` flag or the `OP_ACCOUNT` environment variable), either the first var will fail to be read OR the other two will fail to be read.
Which is to say that every secret reference in an environment at any given time MUST be from a single account. If there is even one reference that is for a different account, there is no way to execute `op run` without it failing (as far as I can tell).
Let me know if that clears up the scenario I'm dealing with.