1Password Go SDK

Build integrations that programmatically interact with 1Password.

Documentation | Examples

---

🚀 Get started

You can choose between two authentication methods for the 1Password Go SDK: local authorization prompts from the 1Password desktop app or automated authentication with a 1Password Service Account.

This project is licensed under MIT. Use of the 1Password APIs and services accessed through these tools is governed by the 1Password API Terms of Service.

Option 1: 1Password desktop app

1Password desktop app authentication is best for local integrations that require minimal setup from end users and sensitive workflows that require human-in-the-loop approval. To set up the SDK to authenticate with the 1Password app:

1. Install the 1Password desktop app and sign in to your account in the app.

2. Select your account or collection at the top of the sidebar, then navigate to Settings > Developer.

3. Under Integrate with the 1Password SDKs, select Integrate with other apps.

4. If you want to authenticate with biometrics, navigate to Settings > Security, then turn on the option to unlock using Touch ID, Windows Hello, or system authentication.

5. Install the 1Password Go SDK in your project:

   go get github.com/1password/onepassword-sdk-go
   

6. To use the Go SDK in your project, replace your-account-name in the code below with the name of your 1Password account as it appears at the top left sidebar of the 1Password desktop app.

package main

import (
    "context"
    "os"

    "github.com/1password/onepassword-sdk-go"
)

func main() {
    
    client, err := onepassword.NewClient(
                context.TODO(),
                onepassword.WithDesktopAppIntegration("your-account-name"),
                // TODO: Set the following to your own integration name and version.
                onepassword.WithIntegrationInfo("My 1Password Integration", "v1.0.0"),
    )
    if err != nil {
	// handle err
    }
    secret, err := client.Secrets().Resolve(context.TODO(), "op://vault/item/field")
    if err != nil {
        // handle err
    }
    // do something with the secret
}

Make sure to use secret reference URIs with the syntax op://vault/item/field to securely load secrets from 1Password into your code.

Option 2: 1Password Service Account

Service account authentication is best for automated access and limiting your integration to least privilege access. To set up the SDK to authenticate with a service account token:

1. Create a service account and give it the appropriate permissions in the vaults where the items you want to use with the SDK are saved.

2. Provision your service account token. We recommend provisioning your token from the environment. For example, to export your token to the OP_SERVICE_ACCOUNT_TOKEN environment variable:

   macOS or Linux

   export OP_SERVICE_ACCOUNT_TOKEN=<your-service-account-token>
   

   Windows

   $Env:OP_SERVICE_ACCOUNT_TOKEN = "<your-service-account-token>"
   

3. Install the 1Password Go SDK in your project:

   go get github.com/1password/onepassword-sdk-go
   

4. Use the Go SDK in your project:

package main

import (
    "context"
    "os"

    "github.com/1password/onepassword-sdk-go"
)

func main() {
    token := os.Getenv("OP_SERVICE_ACCOUNT_TOKEN")

    client, err := onepassword.NewClient(
                context.TODO(),
                onepassword.WithServiceAccountToken(token),
                // TODO: Set the following to your own integration name and version.
                onepassword.WithIntegrationInfo("My 1Password Integration", "v1.0.0"),
    )
    if err != nil {
	// handle err
    }
    secret, err := client.Secrets().Resolve(context.TODO(), "op://vault/item/field")
    if err != nil {
        // handle err
    }
    // do something with the secret
}

Make sure to use secret reference URIs with the syntax op://vault/item/field to securely load secrets from 1Password into your code.

Supported functionality

1Password SDKs are in active development. We're keen to hear what you'd like to see next. Let us know by upvoting or filing an issue.

Item management

Operations:

• Retrieve secrets
• Retrieve items
• Create items
• Update items
• Delete items
• Archive items
• List items
• Share items
• Generate PIN, random and memorable passwords

Field types:

• API Keys
• Passwords
• Concealed fields
• Text fields
• Notes
• SSH private keys, public keys, fingerprint and key type
• One-time passwords
• URLs
• Websites (used to suggest and autofill logins)
• Phone numbers
• Credit card types
• Credit card numbers
• Emails
• References to other items
• Address
• Date
• MM/YY
• File attachments and Document items
• Menu
• Passkeys

Vault management

• Retrieve vaults
• Create vaults
• Update vaults
• Delete vaults
• List vaults
• Manage group vault permissions
• Manage user vault permissions

User & access management

• Provision users
• Retrieve users
• List users
• Suspend users
• Retrieve groups
• List groups
• Create groups
• Update group membership

Environments management

• Read 1Password Environments (beta)

Compliance & reporting

• Watchtower insights
• Travel mode
• Events (#76). For now, use 1Password Events Reporting API directly.

Authentication

• 1Password Service Accounts
• User authentication
• 1Password Connect. For now, use 1Password/connect-sdk-go.

Cross compilation

If you want to cross compile the Go SDK while using the 1Password desktop app to authenticate, you'll need to enable CGO.

CGO can be enabled either by default if your system permits that, or deliberately if your system doesn't permit that by:

• Setting the CGO_ENABLED env var to 1.
• Downloading and selecting the right cross-compiler depending on your desired target and host system.

📖 Learn more

• Load secrets
• Read 1Password Environments (beta)
• Manage items
• Manage files
• Share items
• List vaults and items
• Manage vaults
• Manage vault permissions
• Manage groups
• 1Password SDK concepts