> ## Documentation Index > Fetch the complete documentation index at: https://www.1password.dev/llms.txt > Use this file to discover all available pages before exploring further. # Secret reference syntax export const CodeResult = ({children, resultLang, wrap, expandable}) => { const parseChildren = () => { let language = "text"; let codeContent = ""; const extractText = node => { if (typeof node === "string") { return node; } if (Array.isArray(node)) { return node.map(extractText).join(""); } if (node?.props?.children) { return extractText(node.props.children); } return ""; }; const extractLanguage = node => { if (!node) return null; if (node.props?.className) { const className = node.props.className; const langMatch = className.match(/language-(\w+)/); if (langMatch) { return langMatch[1]; } } if (node.props?.["data-language"]) { return node.props["data-language"]; } if (node.props?.language) { return node.props.language; } return null; }; if (typeof children === "string") { codeContent = children; } else if (Array.isArray(children)) { codeContent = extractText(children); for (const child of children) { const detectedLang = extractLanguage(child); if (detectedLang) { language = detectedLang; break; } } } else if (children?.props) { const detectedLang = extractLanguage(children); if (detectedLang) { language = detectedLang; } codeContent = extractText(children); } const parts = codeContent.split("#code-result"); if (parts.length < 2) { return { command: codeContent.trim(), result: null, language, defaultOpen: false }; } const resultText = parts[1].trim(); const defaultOpen = resultText.startsWith("open"); const cleanResult = defaultOpen ? resultText.slice(4).trim() : resultText; return { command: parts[0].trim(), result: cleanResult, language, defaultOpen }; }; const {command, result, language, defaultOpen} = parseChildren(); const [isOpen, setIsOpen] = useState(defaultOpen); if (!result) { return children; } return
{}
{}
{isOpen &&
}
; }; export const HighlightCard = ({title, preheader, link, src, darkSrc, children, useButton = true}) => { return
{preheader &&
{preheader}
}

{src && <> {darkSrc ? <> : } } {title}

{children}
{link &&
{useButton ? {link.text || "Learn more"} : {link.text || "Learn more"} }
}
; }; An environment file using a plaintext secret and the same file using a secret reference. Secret reference URIs point to where a secret is saved in your 1Password account using the names (or [unique identifiers](/cli/reference/#unique-identifiers-ids)) of the vault, item, section, and field where the information is stored. ```shell theme={null} op:////[section-name/] ``` Secret references remove the risk of exposing plaintext secrets in your code and reflect changes you make in your 1Password account, so when you run a script you get the latest value. You can use secret references with:

Load secrets into environment variables, configuration files, and scripts.

Programmatically access your secrets with Go, JavaScript, and Python.

Use secret references to secure your secrets management workflows.

Create, preview, and read secret references in your code.

Securely access your secrets in Kubernetes, CircleCI, GitHub Actions, Jenkins, Terraform, Pulumi, Postman, and more.

 ## Get secret references ### With the 1Password desktop app
To see the option to copy secret references in the 1Password desktop app, first turn on the [integration with 1Password CLI](/cli/app-integration). Then: 1. Open the item where the secret you want to reference is stored. 2. Select next to the field that contains the secret you want to reference, then select Copy Secret Reference.
An item in 1Password with the Copy Secret Reference option selected. <> {props.img && (
An item in 1Password with the Copy Secret Reference option selected.
)}
### With 1Password for VS Code You can use 1Password for VS Code to [insert secret references](/vscode/#get-values) from 1Password as you edit your code. First, [install the extension](/vscode/). Then: 1. Open the **[Command Palette ](https://code.visualstudio.com/api/ux-guidelines/command-palette)**. 2. Enter `1Password: Get from 1Password`. 3. Enter the item name or ID. 4. Select the field to use. ### With 1Password CLI To get a secret reference with 1Password CLI, run [`op item get`](/cli/reference/management-commands/item/#item-get) with the `--format json` flag and include the `--fields` flag to specify a field label. Then use [jq ](https://jqlang.github.io/jq/) to retrieve the secret reference from the JSON output. For example: ```shell theme={null} op item get GitHub --format json --fields username | jq .reference #code-result "op://development/GitHub/username" ``` To get secret references for every field on an item, use [`op item get`](/cli/reference/management-commands/item/#item-get) with the `--format json` flag without specifying a field. ```shell theme={null} op item get GitHub --format json ``` Each field object will include a `reference` key that contains its secret reference. For the example `GitHub` item, the output looks like this: ```json highlight={8,17,29,40} theme={null} "fields": [ { "id": "username", "type": "STRING", "purpose": "USERNAME", "label": "username", "value": "wendy_appleseed@agilebits.com", "reference": "op://development/GitHub/username" }, { "id": "password", "type": "CONCEALED", "purpose": "PASSWORD", "label": "password", "value": "GADbhK6MjNZrRftGMqto", "entropy": 115.5291519165039, "reference": "op://development/GitHub/password", "password_details": { "entropy": 115, "generated": true, "strength": "FANTASTIC" } }, { "id": "notesPlain", "type": "STRING", "purpose": "NOTES", "label": "notesPlain", "reference": "op://development/GitHub/notesPlain" }, { "id": "5ni6bw735myujqe4elwbzuf2ee", "section": { "id": "hv46kvrohfj75q6g45km2uultq", "label": "credentials" }, "type": "CONCEALED", "label": "personal_token", "value": "ghp_WzgPAEutsFRZH9uxWYtw", "reference": "op://development/GitHub/credentials/personal_token" } ] } ``` ## Syntax rules ### Supported characters Secret references are case-insensitive and support the following characters: * alphanumeric characters (`a-z`, `A-Z`, `0-9`) * `-`, `_`, `.` and the whitespace character If a secret reference includes a whitespace, enclose the secret reference in quotation marks. For example: ```shell theme={null} op read "op://development/aws/Access Keys/access_key_id" ``` Any part of a secret reference that includes an unsupported character must be referred to by its [unique identifier (ID)](/cli/reference/#unique-identifiers-ids) instead of its name. To get an ID, run [`op item get`](/cli/reference/management-commands/item#item-get) with the output set to JSON. For example, to get the ID for a custom text field named `test/`: ``` op item get PagerDuty --fields label=test/ --format json #code-result { "id": "hu4vwo3bjkawq2uw2fkn5pkjzu", "section": { "id": "add more" }, "type": "STRING", "label": "text/", "value": "t", "reference": "op://Management/PagerDuty/add more/hu4vwo3bjkawq2uw2fkn5pkjzu" } ``` ### File attachments To reference a file attachment, use the file name in place of a field name: ```shell theme={null} op://vault-name/item-name/[section-name/]file-name ``` ### Externally-set variables If you use different sets of secrets in different environments, you can include variables within secret references and then set the variable to switch between secrets. For example, the `APP_ENV` variable in the example below can be set to `dev` to load development credentials or `prod` to load production credentials, assuming the credentials are stored in 1Password vaults named `dev` and `prod`. ```shell app.env theme={null} MYSQL_DATABASE = "op://$APP_ENV/mysql/database" MYSQL_USERNAME = "op://$APP_ENV/mysql/username" MYSQL_PASSWORD = "op://$APP_ENV/mysql/password" ``` Learn how to use variables to switch between sets of secrets in [environment files](/cli/secrets-environment-variables#optional-differentiate-between-environments) and [config files](/cli/secrets-config-files#step-3-differentiate-between-environments). ### Field and file metadata attributes You can use secret references with query parameters to get more information about an item. #### Attribute parameter To get information about item fields and file attachments, use the `attribute` (or `attr`) query parameter. ```html Fields theme={null} op:///[/
]/?attribute= ``` ```html File attachments theme={null} op:///[/
]/?attribute= ```
Field attributes: | Attribute | Definition | | --------- | ------------------------------------------------------------------------------- | | `type` | The field's type | | `value` | The field's content | | `id` | The field's unique identifier | | `purpose` | The designation of a built-in field (can be "username", "password", or "notes") | | `otp` | Use with one-time password fields to generate a one-time password code |
File attachment attributes: | Attribute | Definition | | --------- | --------------------------------------- | | `type` | The field's type | | `content` | The file attachment's content | | `size` | The size of the file attachment | | `id` | The file attachment's unique identifier | | `name` | The name of the file attachment |
For example, to retrieve an item's one-time password code: ```shell theme={null} op read "op://development/GitHub/Security/one-time password?attribute=otp" #code-result 359836 ``` To retrieve a field's type: ```shell theme={null} op read "op://Personal/aws/access credentials/username?attribute=type" #code-result string ``` To retrieve the name of a file attachment: ```shell theme={null} op read "op://app-infra/ssh/key.pem?attribute=name" #code-result key.pem ``` #### SSH format parameter To get an SSH private key in the OpenSSH format, include the `ssh-format` query parameter with the value `openssh` on a secret reference for the SSH key's `private key` field. ```shell theme={null} op read "op://Private/ssh keys/ssh key/private key?ssh-format=openssh" #code-result -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABD3rRrf8J ruD0CxZTYfpbTYAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIJ5B/GnxX6t9jMwQ G7QE7r5daJLkMKTZhNZhWfvzK2y+AAAAkLgQAivYu/+12/YrZhK5keIAZf4ZgsZsZ2JI2q qbx23PqgO93oGy1iCxXe3kngQL4cM6lwOZPsZPKCinkN6KxEr6RnXqFRHJbMpOiGeZhTuD rjeo77HqFdxDqDeckB77XCKL0Ew28H5JlM/WO31XR3Z4VBAgTe+BQLjrFV8WU5UX38hpBJ PMJyRsK72ZUDDaGQ== -----END OPENSSH PRIVATE KEY----- ``` ## Secret reference examples ### A field inside a section To create a secret reference that refers to the PagerDuty email field, which is within the Admin section, use: ```shell theme={null} op://Management/PagerDuty/Admin/email ```
* `Management` refers to the vault where the item is saved * `PagerDuty` refers to the item * `Admin` refers to the section where the field is a part of * `email` refers to the field where the secret you want to reference is located
PagerDuty 1Password item
### A field without a section To create a secret reference for the Stripe publishable-key field, which is not part of a section, use: ```shell theme={null} op://dev/Stripe/publishable-key ```
* `dev` refers to the vault where the item is saved * `Stripe` refers to the item * `publishable-key` refers to the field where the secret you want to reference is located
Stripe 1Password item
## Learn more * [Use secret references with 1Password CLI](/cli/secret-references/) * [Get started with 1Password SDKs](/sdks/) * [Load secrets into config files](/cli/secrets-config-files/) * [Load secrets into the environment](/cli/secrets-environment-variables/) * [Template syntax](/cli/secrets-template-syntax/) * [Workflow: Secure your developer secrets](/get-started/secure-developer-secrets)