Arch: Unable to read secrets

shahab96
shahab96
Community Member
in CLI

I started by attempting to read a secret with regular secret reference format, copied out of the app and pasted into my .bashrc. However I get the following error:

[ERROR] 2023/07/24 05:23:54 could not read secret op://Lab/LabToken/credential: error initializing client: Validation: (failed to session.DecodeSACredentials), Server: (failed to DecodeSACCredentials), failed to parseToken, format is invalid

Interestingly enough I actually also get this error when attempting to run op whoami

❯ op whoami
[ERROR] 2023/07/24 05:23:07 failed to DecodeSACCredentials: failed to parseToken, format is invalid

Not sure what's going on here, any help would be appreciated

1Password Version: 8.10.8
Extension Version: 2.11
OS Version: archlinux 6.4.4
Browser: Firefox

Comments

  • ArunV1P
    ArunV1P

    Hi @shahab96, that could happen if you have the environment variable OP_SERVICE_ACCOUNT set with an incorrect token.

    Could you unset that environment variable, log into your account with op signin and then try whoami or the secret reference?

    There's definitely scope for us to improve this messaging, so I'll track this internally. Thank you for surfacing this!

  • shahab96
    shahab96
    Community Member
    edited July 2023

    Hi @ArunV1P

    I attempted unsetting the token, but it didn't make any difference. Both commands still fail with the same error.

    Thanks!
    Shahab

  • ArunV1P
    ArunV1P

    To confirm, did you sign into your 1Password account with op signin after unsetting the OP_SERVICE_ACCOUNT token?

  • shahab96
    shahab96
    Community Member

    Sorry, I missed that part. Running op signin did fix it. Thank you!

  • ArunV1P
    ArunV1P

    Glad that helped!

  • click94
    click94
    Community Member
    edited August 2023

    hi @ArunV1P i'm currently running into this while testing secrets automation. i unset that environment variable OP_SERVICE_ACCOUNT, quit terminal, reopened and logged into my account with op signin. but how can i successfully use OP_SERVICE_ACCOUNT as an env variable? thanks

  • ArunV1P
    ArunV1P

    Hi @click94, you can prefix the OP_SERVICE_ACCOUNT before your op CLI command like so:

    OP_SERVICE_ACCOUNT=value op vault ls

    Or, you can export OP_SERVICE_ACCOUNT=value and within the same shell session, run a op CLI command and it'd use the Service Account token.

    I hope that helps, but feel free to followup if you have any questions! Preferably as a new forum topic if it's a long one. :)

This discussion has been closed.