1Password

OpenClaw 1Password Integration

Keep your AI workflows secure with 1Password. OpenClaw integrates with the 1Password CLI (op) to inject secrets at runtime — no hardcoded credentials, no environment variable sprawl.

Setup

Step 1: Install 1Password CLI

# macOSbrew install 1password-cli# Verifyop --version

Step 2: Enable Desktop App Integration

1. Open 1Password app
2. Settings → Developer → "Integrate with 1Password CLI"
3. Toggle on

This allows op to authenticate through the desktop app — no separate auth needed.

Step 3: Configure OpenClaw

integrations:  onePassword:    enabled: true    # Uses system auth (desktop app integration)    vault: "Personal"  # default vault    # Optional: multiple vaults    vaults:      - "Personal"      - "Work"      - "Shared Secrets"

Step 4: Test

op item list

Should list your vault items.

Secret Injection

The core use case: inject 1Password secrets into OpenClaw skills without hardcoding.

In Skills

skills:  deploy:    env:      AWS_ACCESS_KEY: "op://Work/AWS Production/access-key-id"      AWS_SECRET: "op://Work/AWS Production/secret-access-key"      DB_PASSWORD: "op://Work/Database/password"

When the skill runs, OpenClaw fetches secrets from 1Password and injects them as environment variables. Secrets never touch disk.

In Config

Reference 1Password items directly in your OpenClaw config:

channels:  telegram:    token: "op://Personal/OpenClaw Bot/token"

Natural Language Access

What's in my Work vault?→ 47 items: AWS credentials, Database passwords, API keys...Get the staging database password→ [copied to clipboard, not shown in chat]Create a new password for: ProjectX API Key→ Generated 32-char password, saved to Work vault ✓

Use Cases

• Deployment secrets: Inject credentials at deploy time
• API key management: Reference keys by name, not value
• Team sharing: Share secrets via 1Password without exposing values
• Rotation: Update secrets in one place, everywhere auto-refreshes

Troubleshooting

op not authenticated? Run op signin or enable Desktop App Integration in 1Password settings.

Secret not found? Check vault name and item name are exact (case-sensitive). Use op item list to verify.

Permission denied? Some vaults require separate authentication. Check vault permissions in 1Password admin.