# 1Password Credential Extraction Patterns

## Problem: `--fields credential --format plain` returns empty

When `op item get <ID> --vault Hermes --fields credential --format plain` returns an empty string, the field may be labeled differently internally (e.g. `password` instead of `credential`).

## Fallback: Parse full JSON

```bash
# Save full item JSON
op item get "<ID>" --vault Hermes --format json > /tmp/op_item.json

# Extract the credential field by iterating all fields
HA_TOKEN=$(python3 -c "
import json
with open('/tmp/op_item.json') as f:
    item = json.load(f)
for field in item.get('fields', []):
    if field.get('label') == 'credential':
        print(field['value'])
        break
")
echo "Token length: ${#HA_TOKEN}"  # Should be > 0
```

## Finding Items by Keyword

```bash
op item list --vault Hermes --format json | python3 -c "
import json, sys
items = json.loads(sys.stdin.read())
for item in items:
    title = item.get('title', '')
    if any(k in title.lower() for k in ['home', 'assistant', 'token']):
        print(f'{item[\"id\"]} → {title}')
"
```

## HA API Token Items in This Homelab

Two items titled "Home Assistant API Token" exist in vault "Hermes":
- `ewviwqhnpcpd2tg2gh5jbv76xm` — older item, has `username` (api_token) + `password` fields
- `mntt343ghnetkyeyeboxxksfde` — newer item, has `credential` + `url` fields

Both contain the same token. The `url` field on the newer item: `https://homeassistant.familie-schoen.com`

## Verified Working Extraction

```bash
# This pattern works reliably:
op item get "mntt343ghnetkyeyeboxxksfde" --vault Hermes --format json > /tmp/ha_item.json
HA_TOKEN=$(python3 -c "
import json
with open('/tmp/ha_item.json') as f:
    item = json.load(f)
for f in item.get('fields', []):
    if f.get('label') == 'credential':
        print(f['value']); break
")
# Verify
curl -sk -H "Authorization: Bearer $HA_TOKEN" "https://homeassistant.familie-schoen.com/api/"
# Expected: {"message":"API running."}
```

## `--value` Flag Does NOT Exist (Service Account Mode)

When using 1Password CLI as a service account (`User Type: SERVICE_ACCOUNT`), the `--value` flag is NOT available:

```bash
# FAILS: unknown flag: --value
op item get <ID> --vault Hermes --fields label=credential --reveal --value

# WORKS: --reveal alone outputs the value (may have surrounding quotes)
op item get <ID> --vault Hermes --fields label=credential --reveal
# Strip quotes in shell:
export HA_TOKEN=$(op item get <ID> --vault Hermes --fields label=credential --reveal 2>/dev/null | tr -d '"')
```

## Quick Inline Pattern (No Temp File)

For scripts that need the token without writing to disk:

```bash
export HA_TOKEN=$(op item get mntt343ghnetkyeyeboxxksfde --vault Hermes --fields label=credential --reveal 2>/dev/null | tr -d '"')
echo "Token length: ${#HA_TOKEN}"  # Should be ~183
curl -s -H "Authorization: Bearer $HA_TOKEN" "http://10.0.30.10:8123/api/" 
# Expected: {"message":"API running."}
```