1password-sdk

1Password SDK

Choose your interface

Need	Use
Shell scripts, CI one-liners	CLI (1password-cli skill)
Agent Environment management	MCP (1password-mcp skill)
Application code with type safety	SDK (this skill)

Supported languages

Language	Package	Reference
Go	github.com/1Password/onepassword-sdk-go	references/go.md
JavaScript/TypeScript	@1password/sdk	references/javascript.md
Python	onepassword-sdk	references/python.md

Docs index: https://www.1password.dev/llms.txt

Authentication methods

Method	Best for	SDK support
Desktop app	Local dev, human approval, biometrics	Go, JS, Python
Service account	CI/CD, headless, least privilege	Go, JS, Python
Connect server	Self-hosted REST API in your infra	Connect SDKs (separate)

Never embed service account tokens in source code. Load from environment variables.

Decision flow

1. Identify language — Go, JS/TS, or Python
2. Choose auth — desktop app (local dev) or service account (automation)
3. Identify operation — read secrets, manage items, read Environments
4. Load language reference for install + init + example code
5. Use secret references in config where possible; resolve at runtime

Core concepts

• Items — login credentials, API keys, secure notes in vaults
• Vaults — containers with access permissions
• Environments — project-scoped secret collections (beta)
• Secret references — op://vault/item/field resolved at runtime

Concepts guide: https://www.1password.dev/sdks/concepts

Quick starts by language

Go

go get github.com/1Password/onepassword-sdk-go

See references/go.md

JavaScript/TypeScript

npm install @1password/sdk

See references/javascript.md

Python

pip install onepassword-sdk

See references/python.md

Service account setup

op service-account create "my-app" --vault "App Secrets:read_items"
export OP_SERVICE_ACCOUNT_TOKEN="ops_..."

Scope vaults to minimum required permissions.

Environment variables (beta)

Read project secrets from Environments programmatically: https://www.1password.dev/environments/read-environment-variables

Connect SDKs (self-hosted)

For self-hosted Connect REST API deployments, use separate Connect SDKs:

• https://github.com/1Password/connect-sdk-go
• https://github.com/1Password/connect-sdk-js
• https://github.com/1Password/connect-sdk-python

Safety rules

• Resolve secrets at runtime, never hardcode
• Use service accounts with least-privilege vault access
• Desktop app auth prompts user for every sensitive operation
• Do not log secret values — log operation success by item/field name
• Add SDK token env vars to .gitignore patterns