Back to Details

op-cli

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

1Password CLI (
op
) — Secure Handling

1Password CLI（
op
）——安全操作规范

Core Rule: Never Print Secrets

核心规则：绝不打印密钥

NEVER use 
op
commands that would print secret values into the conversation. Always pipe directly to the consuming tool or use 
wc -c
/ redaction to verify without exposing.
bash
undefined
绝对不要使用会将密钥值输出到会话中的
op
命令。应始终直接通过管道传递给消费工具，或使用
wc -c
/脱敏方式在不暴露内容的情况下进行验证。
bash
undefined

WRONG — would print secret to stdout (do not run)

错误示例——会将密钥打印到标准输出（请勿执行）

op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal

op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal

RIGHT — pipe directly to consumer

正确示例——直接通过管道传递给消费工具

op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal |
wrangler secret put SECRET_NAME --env ENV
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal |
wrangler secret put SECRET_NAME --env ENV

RIGHT — verify a value exists without exposing it

正确示例——在不暴露内容的情况下验证值是否存在

op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal 2>/dev/null | wc -c
undefined
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal 2>/dev/null | wc -c
undefined

Item Titles with Slashes

包含斜杠的条目名称

Many 1Password items use path-style titles (e.g. 
pool-party/testnet-pool-party-public/credentials
). The 
op://
URI format breaks with these because it uses 
/
as a delimiter.
bash
undefined
许多1Password条目使用路径式名称（例如
pool-party/testnet-pool-party-public/credentials
）。
op://
URI格式会因此失效，因为它使用
/
作为分隔符。
bash
undefined

BROKEN — too many '/' segments

失效示例——斜杠分段过多

op read "op://pool-party-testnet/pool-party/testnet-pool-party-public/credentials/PASSWORD"
op read "op://pool-party-testnet/pool-party/testnet-pool-party-public/credentials/PASSWORD"

ERROR: too many '/': secret references should match op://<vault>/<item>[/<section>]/<field>

错误：斜杠数量过多：密钥引用应符合 op://<vault>/<item>[/<section>]/<field> 格式

WORKS — use item ID instead (avoid printing values)

有效示例——改用条目ID（避免输出值）

op item get ITEM_ID --vault VAULT --fields label=FIELD --reveal 2>/dev/null | wc -c
undefined
op item get ITEM_ID --vault VAULT --fields label=FIELD --reveal 2>/dev/null | wc -c
undefined

Discovery Workflow

发现流程

When you don't know the item ID:
bash
undefined
当你不知道条目ID时：
bash
undefined

1. List items in a vault to find the title and ID

1. 列出指定保险库中的条目，找到名称和ID

op item list --vault VAULT_NAME
op item list --vault VAULT_NAME

2. Use the ID (first column) for all subsequent reads

2. 使用ID（第一列）执行后续所有读取操作

op item get ITEM_ID --vault VAULT_NAME --fields label=FIELD_NAME --reveal 2>/dev/null | wc -c
undefined
op item get ITEM_ID --vault VAULT_NAME --fields label=FIELD_NAME --reveal 2>/dev/null | wc -c
undefined

Reading Multiple Fields from One Item

从单个条目读取多个字段

bash
undefined
bash
undefined

Verify which fields exist (safe — shows labels not values)

验证存在哪些字段（安全操作——仅显示标签不显示值）

op item get ITEM_ID --vault VAULT_NAME --format json 2>/dev/null |
python3 -c "import json,sys; [print(f['label']) for s in json.load(sys.stdin).get('fields',[]) for f in [s] if f.get('label')]"
op item get ITEM_ID --vault VAULT_NAME --format json 2>/dev/null |
python3 -c "import json,sys; [print(f['label']) for s in json.load(sys.stdin).get('fields',[]) for f in [s] if f.get('label')]"

Pipe each field to its destination

将每个字段通过管道传递到目标位置

op item get ITEM_ID --vault VAULT --fields label=USERNAME --reveal | consumer_cmd ... op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | consumer_cmd ...
undefined
op item get ITEM_ID --vault VAULT --fields label=USERNAME --reveal | consumer_cmd ... op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | consumer_cmd ...
undefined

Common Piping Patterns

常见管道使用模式

Cloudflare Workers (wrangler)

Cloudflare Workers（wrangler）

bash
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | \
  npx wrangler secret put POOL_PARTY_PUBLIC_PASSWORD --env testnet
bash
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | \
  npx wrangler secret put POOL_PARTY_PUBLIC_PASSWORD --env testnet

Environment Variable (subshell)

环境变量（子shell）

bash
SECRET="$(op item get ITEM_ID --vault VAULT --fields label=TOKEN --reveal 2>/dev/null)"
bash
SECRET="$(op item get ITEM_ID --vault VAULT --fields label=TOKEN --reveal 2>/dev/null)"

Use $SECRET in subsequent commands within the same shell — it won't appear in output

在同一个shell的后续命令中使用$SECRET——它不会出现在输出中

undefined
undefined

kubectl

kubectl

bash
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | \
  kubectl create secret generic my-secret --from-file=password=/dev/stdin
bash
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal | \
  kubectl create secret generic my-secret --from-file=password=/dev/stdin

Verification Without Exposure

无暴露验证

bash
undefined
bash
undefined

Check a value is non-empty (char count)

检查值是否非空（字符计数）

op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal 2>/dev/null | wc -c
op item get ITEM_ID --vault VAULT --fields label=PASSWORD --reveal 2>/dev/null | wc -c

Compare two sources match (exit code only)

比较两个来源是否匹配（仅返回退出码）

if cmp -s <(op item get ID1 --vault V --fields label=F --reveal 2>/dev/null)
<(op item get ID2 --vault V --fields label=F --reveal 2>/dev/null); then echo "match" else echo "differ" fi
undefined
if cmp -s <(op item get ID1 --vault V --fields label=F --reveal 2>/dev/null)
<(op item get ID2 --vault V --fields label=F --reveal 2>/dev/null); then echo "match" else echo "differ" fi
undefined

Troubleshooting

故障排查

ErrorCauseFix
too many '/'
Item title has slashes, 
op://
can't parse it		Use item ID with 
op item get
could not find item
Wrong vault or title mismatchRun 
op item list --vault VAULT
to discover
Empty outputMissing 
--reveal
flag		Add 
--reveal
and pipe to consumer (or `
not signed in
Session expiredRun 
eval "$(op signin)"
(avoid printing the session token)
错误原因解决方法
too many '/'
条目名称包含斜杠，
op://
格式无法解析		使用条目ID搭配
op item get
命令
could not find item
保险库错误或名称不匹配执行
op item list --vault VAULT
进行查找
输出为空缺少
--reveal
参数		添加
--reveal
并通过管道传递给消费工具（或`
not signed in
会话已过期执行
eval "$(op signin)"
（避免输出会话令牌）