llm-1password

An llm plugin that keeps model API keys in 1Password.

I wrote this so llm can resolve keys from op:// references at call time. The durable store holds the reference only.

$ llm 1password doctor
op: /usr/local/bin/op
auth: SERVICE_ACCOUNT

$ llm 1password check
openai OK

refs.json is mode 0600 in a 0700 directory. The wrap that owns resolution is _wrapped_get_key in llm_1password.py.

Install

Requires Python 3.10+, llm 0.32 or newer, and the 1Password CLI.

llm install llm-1password

From a checkout:

git clone https://github.com/dallascrilley/llm-1password.git
cd llm-1password
llm install -e .

If llm itself fails with No module named 'httpx' before any plugin loads, that is an llm 0.32 packaging gap:

pipx inject llm httpx

Confirm the plugin loaded:

llm plugins
llm 1password doctor
llm 1password check

doctor prints the chosen op binary and its user_type. check prints No references registered. until you set one.

Use

llm 1password set openai 'op://Vault/Item/credential'
llm 1password check
llm 1password doctor
llm prompt 'hello'
llm 1password unset openai

set writes the reference under llm's user directory at 1password/refs.json. It does not write keys.json. The llm prompt line needs a reference op read can resolve. Run check first and look for OK.

If you previously stored a plaintext key for the same alias, remove that alias (llm keys path) so this plugin owns the name.

check exits 1 if any registered reference fails to resolve.

How resolution works

1. If $HOME/.local/bin/op exists, is executable, and is a non-world-writable regular file, the plugin uses it. That lets a local wrapper sit in front of the official CLI.
2. Otherwise it uses op on PATH, with the same file checks.
3. It runs op read -- <ref>. A missing binary, a non-zero exit, a timeout, empty output, or a non-UTF-8 payload aborts the model call.

llm 1password doctor prints the chosen binary and the op whoami user_type field (SERVICE_ACCOUNT, or whatever op reports).

An explicit --key / input= value is not replaced by a registered alias unless that value itself is the alias. Unregistered op:// strings in keys.json or the environment are rejected rather than fetched or sent to the provider (_reject_bare_op_uri).

Security model

If op read fails, the plugin raises an error and does not call the model.

What this package does not do

• Resolve op:// inside prompts, templates, or fragments.
• Hide the op:// URI from ps while op read is running.
• Wrap assignments such as model.key = "op://...". Those bypass llm.get_key.
• Uninstall leftover plaintext keys from keys.json.

See SECURITY.md for reporting and the guarantees the package aims for.

License

Apache-2.0