> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mirage.strukto.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# 1Password

> Read workspace credentials from 1Password with a service account.

A pointer with `from: 1password` reads from [1Password](https://1password.com)
through a service account when the workspace starts. The value stays in the
memory of the process running the workspace; see
[how credentials work](https://docs.mirage.strukto.ai/home/service-credentials.md).

## Install

> [tab] Python
>
> Install the extra where Mirage runs:
>
> ```bash theme={null}
> # the mirage CLI
> uv tool install 'mirage-ai[1password]'
> # a Python project
> uv add 'mirage-ai[1password]'
> ```

> [tab] TypeScript
>
> ```bash theme={null}
> npm install @1password/sdk
> ```

## Create a service account

1. Sign in to 1Password.com and open **Developer** > **Directory**. Under
   Infrastructure Secrets Management, select **Other**, then
   **Create a Service Account**.
2. Give it read access to the vaults the workspace uses.
3. Select **Create Account**, then **Save in 1Password**. The token is shown
   only once.

A service account can't read your Personal, Private or Employee vault, or the
default Shared vault, so keep the workspace's secrets in another vault.

Set the token in the environment of the process running Mirage:

```bash theme={null}
export OP_SERVICE_ACCOUNT_TOKEN=<your-service-account-token>
```

The local daemon reads its environment when it starts, so run
`mirage daemon restart` after setting the token.

## Point at a field

In 1Password, open the item and choose **Copy Secret Reference** on a field.
Use the reference as `ref`, and the field's name, its last part, as `key`:

```yaml workspace.yaml theme={null}
mounts:
  /slack:
    vfs: slack
    config:
      token:
        from: 1password
        ref: op://Engineering/Slack/credential
        key: credential
```

See 1Password's [secret reference syntax](https://developer.1password.com/docs/cli/secret-reference-syntax/)
for references to fields inside sections.

## Read several fields from one item

A reference to the item, without a field, reads all of its fields together,
after looking up the vault and item. `key` then picks a field by its label. For
an item `AWS` with fields labelled `access_key_id` and `secret_access_key`:

```yaml workspace.yaml theme={null}
mounts:
  /s3:
    vfs: s3
    config:
      bucket: my-bucket
      aws_access_key_id:
        from: 1password
        ref: op://Engineering/AWS
        key: access_key_id
      aws_secret_access_key:
        from: 1password
        ref: op://Engineering/AWS
        key: secret_access_key
```

An item's notes are read with `key: notesPlain`.

## Use another service account

To read with a different service account, declare a source with its token and
use its name in `from`:

```yaml workspace.yaml theme={null}
secrets:
  eng:
    source: 1password
    config:
      token:
        from: env
        key: OP_ENG_TOKEN

mounts:
  /slack:
    vfs: slack
    config:
      token:
        from: eng
        ref: op://Engineering/Slack/credential
        key: credential
```

The token in a source's config can read only from `env` or a dotenv file.

## Cloudflare Workers

A Worker needs the SDK, an import and an alias. See
[Read secrets from AWS and 1Password](https://docs.mirage.strukto.ai/typescript/cloudflare-quickstart.md#read-secrets-from-aws-and-1password).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.