1Password

A pointer with from: 1password reads from 1Password through a service account when the workspace starts. The value stays in the memory of the process running the workspace; see how credentials work.

Install

Python
TypeScript

Install the extra where Mirage runs:

# the mirage CLI
uv tool install 'mirage-ai[1password]'
# a Python project
uv add 'mirage-ai[1password]'

npm install @1password/sdk

Create a service account

Sign in to 1Password.com and open Developer > Directory. Under Infrastructure Secrets Management, select Other, then Create a Service Account.
Give it read access to the vaults the workspace uses.
Select Create Account, then Save in 1Password. The token is shown only once.

A service account can’t read your Personal, Private or Employee vault, or the default Shared vault, so keep the workspace’s secrets in another vault. Set the token in the environment of the process running Mirage:

export OP_SERVICE_ACCOUNT_TOKEN=<your-service-account-token>

The local daemon reads its environment when it starts, so run mirage daemon restart after setting the token.

Point at a field

In 1Password, open the item and choose Copy Secret Reference on a field. Use the reference as ref, and the field’s name, its last part, as key:

workspace.yaml

mounts:
  /slack:
    vfs: slack
    config:
      token:
        from: 1password
        ref: op://Engineering/Slack/credential
        key: credential

See 1Password’s secret reference syntax for references to fields inside sections.

Read several fields from one item

A reference to the item, without a field, reads all of its fields together, after looking up the vault and item. key then picks a field by its label. For an item AWS with fields labelled access_key_id and secret_access_key:

workspace.yaml

mounts:
  /s3:
    vfs: s3
    config:
      bucket: my-bucket
      aws_access_key_id:
        from: 1password
        ref: op://Engineering/AWS
        key: access_key_id
      aws_secret_access_key:
        from: 1password
        ref: op://Engineering/AWS
        key: secret_access_key

An item’s notes are read with key: notesPlain.

Use another service account

To read with a different service account, declare a source with its token and use its name in from:

workspace.yaml

secrets:
  eng:
    source: 1password
    config:
      token:
        from: env
        key: OP_ENG_TOKEN

mounts:
  /slack:
    vfs: slack
    config:
      token:
        from: eng
        ref: op://Engineering/Slack/credential
        key: credential

The token in a source’s config can read only from env or a dotenv file.

Cloudflare Workers

A Worker needs the SDK, an import and an alias. See Read secrets from AWS and 1Password.

Getting Started

Examples

Agents

Configuration

VFS

Integration

CLIs

Mirage Shell

Policy

Machines

Infrastructure

Notifications

Help

Install

Create a service account

Point at a field

Read several fields from one item

Use another service account

Cloudflare Workers