Skip to main content

Documentation Index

Fetch the complete documentation index at: https://www.1password.dev/llms.txt

Use this file to discover all available pages before exploring further.

The GitHub shell plugin allows you to use 1Password to securely authenticate the GitHub CLI with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the plugins.sh file, then you’ll be prompted to authenticate the GitHub CLI with biometrics.

​
Requirements

  1. Sign up for 1Password.
  2. Install and sign in to 1Password for Mac or Linux.
  3. Install 1Password CLI 2.9.0 or later.
  4. Integrate 1Password CLI with the 1Password app.
  5. Install the GitHub CLI .
The following shells are supported:
  • Bash
  • Zsh
  • fish

​
Before you begin: Create and save a GitHub personal access token

Before you can use 1Password to authenticate the GitHub CLI, you’ll need to create a GitHub personal access token. 1Password authenticates the GitHub CLI with your personal access token instead of a username and password. If you’ve already created a personal access token, skip to Step 1. If you haven’t created a personal access token yet, you can create one and use the 1Password browser extension to quickly save it in 1Password:
  1. Open and unlock 1Password in your browser.
  2. Follow the steps to create a GitHub personal access token.
  3. Select Save item when 1Password asks if you want to save an item for the GitHub personal access token.
  4. Choose the vault where you want to save the item, edit the item’s name and details, then select Save item.
The pop-up screen to save your GitHub personal access token in 1Password.

​
Step 1: Configure your default credentials

If you use multiple GitHub accountsIf you want to use the GitHub shell plugin with more than one GitHub account, like your personal and work accounts, learn how to set up your plugin to use multiple accounts.
If you use a single GitHub account, select Use as global default on my system. This will set your personal access token as the default in all terminal sessions and directories. If you use multiple GitHub accounts, learn how to use directory-specific defaults for context switching.

​
Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

source ~/.config/op/plugins.sh

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

If this is your first time installing a shell plugin, you’ll also need to add the source command to your RC file or shell profile to persist the plugin beyond the current terminal session. For example:

​
Step 3: Use the CLI

​
Step 4: Remove imported credentials from disk

After saving your GitHub credentials in 1Password, you can remove all local copies you previously had stored on disk. 
rm ~/.config/gh/hosts.yml

​
Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

op plugin list

To choose another plugin to get started with:

op plugin init

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

​
Get help

​
Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn’t contain a field with the required name, you’ll be prompted to rename one of the existing fields.

1Password field namesEnvironment variables
TokenGH_TOKEN
Host (optional)GH_HOST

​
Learn more