Retrieve password and OTP in a single CLI command

teejay87

I'm trying to automate a VPN connection using 1password CLI.

I managed to make it work successfully by requesting password and OTP in two steps, but this is currently requiring two separate 1password authentications, which is quite slow.

I was wondering if there is a command to retrieve both secrets at a time.

I tried using op item get itemId --fields password --otp, but I get the error cannot use '--otp' and '--fields' together.

If I use instead op item get itemId --fields=password,"onetime password" the otpauth:// reference is returned, which is useless in my situation.

I read something about secrets reference and the op read command but I'm not sure wether it may help.

Thanks

---

1Password Version: 8.10.28
Extension Version: 2.26.1
OS Version: Windows 11
Browser: Not Provided

jacob.o_1p

Hey @teejay87, thanks for bringing this to our attention! It looks like this is one of the 1Password CLI's current limitation regarding flags with op item get. Our CLI development team is currently aware of this limitation and is looking into different possible ways to resolve it. I've also gone ahead and created an internal feature request regarding this to try and add a bit more weight onto it.

In the meantime, while our developers look into the limitation, you should be able to use the command op item get itemId --fields password && op item get itemId --otp to have the CLI output both secrets. Thanks again for bringing this to our attention! 😊

teejay87

Thanks Jacob!
That suggestion actually solved my problem, running both commands in a one-liner requires only one authentication, even if it is still a bit slower than a single command.

I struggled a bit to come up with a batch syntax to concatenate password and OTP but finally succeded.
I'm leaving it here for the records, in case someone needed it:

setlocal enabledelayedexpansion
FOR /F "tokens=*" %%g IN ('op item get "VPN" --fields password^&op item get "VPN" --otp') do (SET PWD=!PWD!%%g)

You can then pass the %PWD% variable to the VPN connection command, or everything else you need it for.

teejay87

Thanks Jacob!
That actually solved my problem, running both commands in a one-liner requires only one authentication, even if it is still a bit slower than a single command.

I struggled a bit to come up with a batch syntax to concatenate password and OTP, but finally succeded.

I'm leaving it here for the records, in case someone needed it:

setlocal enabledelayedexpansion
FOR /F "tokens=*" %%g IN ('op item get "VPN" --fields password^&op item get "VPN" --otp') do (SET PWD=!PWD!%%g)

You can then pass the %PWD% variable to the VPN connection command, or everything else you need it for.

jacob.o_1p

Hey Teejay, glad I could help. I also appreciate you sending over what was used to pass the password and one-time password through to your VPN. If you have any other questions please let me know; Have a great day!