opcli

A fast, local 1Password CLI alternative. Reads directly from 1Password's local SQLite database instead of making network calls.

Performance

~30x faster than the official op CLI:

How it works

1. Gets your account password from you, saves it in Keychain
2. Reads the local 1Password SQLite database
3. Derives the Account Unlock Key using 2SKD (HKDF + PBKDF2)
4. Decrypts the keyset chain (AES-256-GCM + RSA-OAEP)
5. Decrypts vault keys and item data

No network calls. No IPC with the desktop app. Just direct crypto.

Installation

Download the latest release from GitHub.

Or build from source:

make
make sign SIGN_IDENTITY="Developer ID Application: Your Name (TEAMID)"

The build requires Xcode Command Line Tools and Go 1.21+.

Code Signing (required for Touch ID)

For Touch ID support, the binary must be signed with a Developer ID certificate.

The release binary is signed with my certificate. To build from source you will need your own.

Usage

# First time: sign in (stores credentials in Keychain)
opcli signin

# Read a field from an item (prompts Touch ID on first use per terminal)
opcli read "op://VaultName/ItemName/fieldname"

# Read a field in a section
opcli read "op://VaultName/ItemName/SectionName/fieldname"

# Read from a specific account (by shorthand, email, UUID, or URL)
opcli read "op://AccountName:VaultName/ItemName/fieldname"
opcli read "op://AccountName:VaultName/ItemName/SectionName/fieldname"

# List all vaults
opcli list

# Dump an item as JSON
opcli get "op://VaultName/ItemName"

# Remove credentials from Keychain
opcli signout

Secret reference format

op://[account:]vault/item/[section/]field

Note: The optional account: prefix is an opcli extension. The official 1Password CLI (op) does not support account names in op:// references — it uses the --account flag or OP_ACCOUNT env var instead. opcli supports those too, but embedding the account in the reference is often more convenient.

Account-qualified references work everywhere op:// refs are supported: read, inject, run (env vars, --env-file, and arg substitution).

Auto-resolving accounts (OPCLI_AUTO_ACCOUNT)

Set OPCLI_AUTO_ACCOUNT=1 to automatically resolve which account a vault belongs to when no account is specified. If the vault name is unambiguous across your signed-in accounts, opcli will use the correct one. If the vault exists in multiple accounts, you'll get an error asking you to specify the account explicitly.

Security

Touch ID

We unfortunately cannot integrate with the 1Password Desktop App for account unlocking, so opcli signin will require you to enter your account password.

Your account password is stored in the macOS Keychain with an app-only ACL. After this, opcli will always use TouchID to authenticate you. If any other app tries to read your account password from the Keychain, macOS will give you a Keychain password prompt:

app wants to use your confidential information stored in "opcli credentials" in your keychain.

...which you should deny.

Sessions

Each terminal session requires Touch ID authentication on first access. After authenticating:

• The session lasts for 10 minutes of inactivity
• Hard limit of 12 hours before re-authentication is required
• Each terminal window/tab has its own session

This mirrors the UX of the official op CLI's desktop app integration.

Requirements

• macOS
• 1Password 8 desktop app installed (creates the local database)

Limitations

• macOS only
• Read-only (no write operations)

Why Not Desktop App Integration?

The official op CLI can avoid password prompts by integrating with the 1Password desktop app.

Unfortunately for us, but fortunately for 1Password security in general, the desktop app requires a code signature from Agile Bits before accepting a connection from the CLI. If opcli does extremely well, maybe we can get Agile Bits to adopt it some day. Until then, we're stuck with managing the account password ourselves.

License

MIT