Use service accounts with 1Password CLI

You can use 1Password Service Accounts with 1Password CLI to manage vaults and items. See supported commands.

​

Requirements

Before you use service accounts with 1Password CLI, you need to:

• Sign up for 1Password.
• Install 1Password CLI.
  
• Create a service account.

​

Get started

To use a service account with 1Password CLI:

1. Set the OP_SERVICE_ACCOUNT_TOKEN environment variable to the service account token:
   • bash, sh, zsh
   • fish
   • Powershell

   export OP_SERVICE_ACCOUNT_TOKEN=<your-service-account-token>
   

   set -x OP_SERVICE_ACCOUNT_TOKEN <your-service-account-token>
   

   $Env:OP_SERVICE_ACCOUNT_TOKEN = "<your-service-account-token>"
   
2. Run the following command to make sure the service account is configured:
   op user get --me
   
   # code-result
   
   ID:                     <service-account-id>
   Name:                   <service-account-name>
   Email:                  <service-account-email>
   State:                  ACTIVE
   Type:                   SERVICE_ACCOUNT
   Created:                2 minutes ago
   Updated:                2 minutes ago
   Last Authentication:    now
   
   

​

Supported commands

You can now run supported 1Password CLI commands authenticated as the service account: To use the following commands, you must specify a vault with the --vault flag if the service account has access to more than one vault: The following commands are only supported for vaults created by the service account:

Unsupported commands

When using a service account, the following commands aren’t supported:

• op connect
• op group
• op user provision
• op user confirm
• op user suspend
• op user delete
• op user recovery

• op events-api
• op vault edit

Although service accounts support some user, group, and vault management commands, we recommend against using them because a full provisioning workflow isn’t supported:

• op user get
• op user list

• op group get
• op group list

​

Commands that make multiple requests

Service accounts have hourly and daily limits on the total number of requests the service account can make. You can sometimes reduce the number of requests made by passing a vault or item’s unique identifier (ID) instead of its name. 1Password CLI commands make one request unless otherwise noted. The following commands make more than one request: