1Password Credential Extraction Patterns

Problem: `--fields credential --format plain` returns empty

When op item get <ID> --vault Hermes --fields credential --format plain returns an empty string, the field may be labeled differently internally (e.g. password instead of credential).

Fallback: Parse full JSON

# Save full item JSON
op item get "<ID>" --vault Hermes --format json > /tmp/op_item.json

# Extract the credential field by iterating all fields
HA_TOKEN=$(python3 -c "
import json
with open('/tmp/op_item.json') as f:
    item = json.load(f)
for field in item.get('fields', []):
    if field.get('label') == 'credential':
        print(field['value'])
        break
")
echo "Token length: ${#HA_TOKEN}"  # Should be > 0

Finding Items by Keyword

op item list --vault Hermes --format json | python3 -c "
import json, sys
items = json.loads(sys.stdin.read())
for item in items:
    title = item.get('title', '')
    if any(k in title.lower() for k in ['home', 'assistant', 'token']):
        print(f'{item[\"id\"]} → {title}')
"

HA API Token Items in This Homelab

Two items titled "Home Assistant API Token" exist in vault "Hermes":

ewviwqhnpcpd2tg2gh5jbv76xm — older item, has username (api_token) + password fields
mntt343ghnetkyeyeboxxksfde — newer item, has credential + url fields

Both contain the same token. The url field on the newer item: https://homeassistant.familie-schoen.com

Verified Working Extraction

# This pattern works reliably:
op item get "mntt343ghnetkyeyeboxxksfde" --vault Hermes --format json > /tmp/ha_item.json
HA_TOKEN=$(python3 -c "
import json
with open('/tmp/ha_item.json') as f:
    item = json.load(f)
for f in item.get('fields', []):
    if f.get('label') == 'credential':
        print(f['value']); break
")
# Verify
curl -sk -H "Authorization: Bearer $HA_TOKEN" "https://homeassistant.familie-schoen.com/api/"
# Expected: {"message":"API running."}

`--value` Flag Does NOT Exist (Service Account Mode)

When using 1Password CLI as a service account (User Type: SERVICE_ACCOUNT), the --value flag is NOT available:

# FAILS: unknown flag: --value
op item get <ID> --vault Hermes --fields label=credential --reveal --value

# WORKS: --reveal alone outputs the value (may have surrounding quotes)
op item get <ID> --vault Hermes --fields label=credential --reveal
# Strip quotes in shell:
export HA_TOKEN=$(op item get <ID> --vault Hermes --fields label=credential --reveal 2>/dev/null | tr -d '"')

Quick Inline Pattern (No Temp File)

For scripts that need the token without writing to disk:

export HA_TOKEN=$(op item get mntt343ghnetkyeyeboxxksfde --vault Hermes --fields label=credential --reveal 2>/dev/null | tr -d '"')
echo "Token length: ${#HA_TOKEN}"  # Should be ~183
curl -s -H "Authorization: Bearer $HA_TOKEN" "http://10.0.30.10:8123/api/" 
# Expected: {"message":"API running."}

2.9 KiB Raw Permalink Blame History