# `Condukt.Secrets.Providers.OnePassword`
[🔗](https://github.com/tuist/condukt/blob/0.16.5/lib/condukt/secrets/providers/one_password.ex#L1)

Loads a session secret from 1Password CLI secret references.

The provider shells out to `op read <ref>` during session initialization.
Authenticate `op` before starting the session, or provide an
`OP_SERVICE_ACCOUNT_TOKEN` in the host process environment.

    MyApp.Agent.start_link(
      secrets: [
        GH_TOKEN: {:one_password, "op://Engineering/GitHub/token"}
      ]
    )

Options:

- `:ref` is the 1Password secret reference. Required.
- `:command` is the executable to run. Defaults to `"op"`.
- `:account` passes `--account` to `op`.
- `:timeout` is the command timeout in milliseconds. Defaults to `30_000`.
- `:env` is a trusted environment override list passed to `op`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*