1Password

Copy a 1Password password, username or one-time code

palupdated 2026-10-27IntegrationIn pal's registry

Open in pal

In pal's registry: the button shows it in pal, which asks before installing; the command does the same from a terminal. This page can't see what your pal has installed.

1Password: Items with their vault, username and website, favourites first
Items with their vault, username and website, favourites first
1Password: The detail pane (cmd+I): the vault over the title, its category and tags, the username, website and when it changed
The detail pane (cmd+I): the vault over the title, its category and tags, the username, website and when it changed
1Password: Copy the password, the username or the one-time code, or open the app
Copy the password, the username or the one-time code, or open the app
1Password: The vault dropdown (Tab) narrows the list to one of the vaults in the settings: Work
The vault dropdown (Tab) narrows the list to one of the vaults in the settings: Work
1 of 4

What it does

Your 1Password items from the keyboard, through the op command line tool. Enter copies the password; the username, the one-time code and the item in the app are one key away.

  • Every item you can see, favourites first, with the vault, the username and the website
  • enter copies the password, cmd+u the username, cmd+t the current one-time code
  • cmd+o opens the item in the 1Password app
  • Search by website, username, category, vault or tag, so github.com finds the login
  • Secrets are fetched only when you copy one and never kept in the list, the index or a log
  • Signed out, or without the op tool, one row says how to sign in or where to get it

Palettes 1

  • 1Passworditemslist

    Every item you can see, favourites first.

    • ↵Copy the password
    • ⌘UCopy the username
    • ⌘TCopy the one-time code
    • ⌘OOpen in 1Password

Actions

  • Copy passwordop item get --fields label=password --reveal; "Copied password" in the HUD.↵
  • Copy username⌘U
  • Copy one-time codeThe current TOTP.⌘T
  • Open in 1PasswordThe app's own view-item link.⌘O

Settings

Extension, [extensions.onepassword]

account
empty text

Passed as --account to every op call: a shorthand, sign-in address, account id or user id. Empty uses the CLI's default.

vaults
none list

Only these vaults are listed, and each becomes a filter in the palette. Empty lists every vault. A change takes effect when the extension host restarts.

ttl
300seconds number

Seconds the item list is kept before op is asked again. Refresh in the panel asks at once.

Defaults shown. Change them in pal's settings window or in the config file.

The README

Everything 1Password does, key by key, from the extension's own README.md

1Password

Your 1Password items through the op CLI. One op item list --format json per listing, kept for ttl seconds so the vault filters and a Refresh inside the ttl do not run the CLI (and its unlock prompt) again; cmd+r past the ttl asks it again. No secret is ever in a row, the index or a log: a pick runs op item get for that one field and puts the value on the clipboard.

One palette, 1Password (items).

Rows

part what
icon a glyph by category: login and password, secure note, card and bank account, identity, SSH key, API credential, server and database, and so on
title the item's title
subtitle the vault, then the username (Personal · alex@example.com)
accessories favorite (amber) for a favourite, then the primary website's host
keywords the website hosts, the username, the category, the vault and the tags, so github.com finds the login
detail pane the vault over the title, the category, favorite and tags as chips, then the username, the website as a link and the update time (cmd+i)

Favourites come first with their tag, then the rest by title. With vaults set, the palette has a filter per vault (All vaults first) and lists only those.

Keyboard

keys action
enter Copy password: op item get <id> --fields label=password --reveal; "Copied password" in the HUD
cmd+u Copy username: the username field
cmd+t Copy one-time code: op item get <id> --otp, the current TOTP
cmd+o Open in 1Password: onepassword://view-item?i=<item>&v=<vault>&a=<account>, the app's own link (the account from op account list, when there is one or account names it)

An item without the field (a secure note has no password, a login without TOTP has no one-time code) keeps the panel open with a toast carrying the CLI's message.

Setup

Install the 1Password CLI (brew install 1password-cli on macOS) and turn on the desktop app integration (1Password, Settings, Developer, "Integrate with 1Password CLI"). The first call from pal makes 1Password ask whether to allow it, which is why the palette lists only once you open it (lazy: "visit"): nothing is asked at pal's start or on its first show, and a reinstalled pal (a new signature) asks again the next time you open the palette. After that every call that needs the vault shows 1Password's own unlock prompt (Touch ID on a Mac), and pal waits up to a minute for it. A terminal's eval $(op signin) session is that shell's only and never reaches pal. op is looked up on PATH, then in /opt/homebrew/bin, /usr/local/bin and /usr/bin, since the app under launchd has a bare PATH.

Signed in or not:

  • Nothing signed in (or no account set up for the CLI at all) is one row, "Sign in to 1Password", whose action opens the CLI's sign-in page. Sign in, then cmd+r.
  • op not installed is one row whose action opens the install page.
  • A vault filter with nothing in it, or an account with no visible items, is one "No items" row.

Settings, [extensions.onepassword]:

key type default what
account text empty Passed as --account to every call: a shorthand, sign-in address, account id or user id. Empty uses the CLI's default account.
vaults list [] Only these vaults are listed, and each is a filter in the palette (All vaults first). Empty lists every vault with no filter. Read when the extension loads, so a change shows after the host restarts.
ttl number (seconds) 300 How long the item list is kept before op is asked again.

Nothing beyond the panel: the CLI does its own unlocking, and the clipboard is the core's.

What it does not do

  • No autofill and no typing into a field: the value goes to the clipboard, you paste it. The copy is a plain one, not marked concealed the way the 1Password app marks its own, so pal's Clipboard History records it like any copy; delete the entry there when that matters.
  • No item creation or editing, no vault management: the app does those.
  • No other fields than password, username and one-time code: a custom field or a note's body is not offered.
  • No SSH agent, no op run: this is the item list and three fields.

Platforms

macOS and Linux, wherever the op CLI runs. The desktop app integration (the biometric prompt) is the app's feature on both and is what pal needs; a service account token in OP_SERVICE_ACCOUNT_TOKEN works without the app.