@kentcdodds/onepassword

@kentcdodds/onepassword

Intent

Bind 1Password Connect as a Kody custom secret provider so agents can use {{secret/1password:…}} placeholders in secret-aware fetch without ever seeing vault values. Resolve item fields over Connect, allowlist hosts from the item's websites, and keep grants on UUID item refs.

Setup

1. Run a 1Password Connect Server and mint a Connect token with read access to the vaults you need.
2. Save the Connect token as the user-scoped secret ONEPASSWORD_CONNECT_TOKEN (never paste the token into chat): configure ONEPASSWORD_CONNECT_TOKEN. After you know your Connect hostname, edit the secret and add that host to allowedHosts if you also call Connect from other package code; the sealed provider path uses the door key internally via bind config.
3. Turn on Custom secret providers for your account (feature flag) from Custom secret providers.
4. Bind this package on Secret providers (or secretProviderBind) with:
   • provider: 1password
   • door secret: ONEPASSWORD_CONNECT_TOKEN
   • config: {"connectHost":"https://your-connect-host"}
5. Prefer UUID item refs so grants work without a vault round-trip: {{secret/1password:i/<item-uuid>/password}}

Placeholder grammar

Field matching (in order): field id, field label (case-insensitive), then purpose shortcuts password → PASSWORD, username → USERNAME, notes → NOTES.

Items must list at least one website URL. Hostnames from those URLs are the allowlist; empty websites fail closed.

Done when

• secretProviderBind succeeds with this package and your Connect host config.
• An ad hoc secret-aware fetch to an item website host resolves {{secret/1password:i/<item-uuid>/password}}.
• Saved packages that need the ref have an Allow grant from secretProviderLock.

See AGENTS.md for agent notes.