Hi,

although it's not exactly what you need by it's easy to modify my solution for your needs:

Here's a simple script to automate the process:

```

!/bin/sh

sudo -u YourUserName /opt/homebrew/bin/op item get idOfTheItemWithTheOTP --otp
```

in the script above replace YourUserName with your username and idOfTheItemWithTheOTP with the id of the item in 1Password that contains the OTP.

(to find out the id of the item you can use the op item list command and look for the item with the OTP for the VPN.

1. place the script to ~/Library/Application\ Support/Tunnelblick/Configurations/<name of the OVPN configuration>.tblk/Contents/Resources/password-replace.user.sh
2. set the script to be executable (chmod +x password-replace.user.sh)
3. next time when you connect to the VPN, Tunnelblick will ask you to save the configuration (again).
4. Then you can tell Tunnelblick to save the username and password in the keychain, for the password use any string, as it will be replaced by actual OTP before the connection.
5. from now on, you will prompted a challenge by 1password (touchid, or password popup, based on your preferences) to connect the Emarsys VPN.

For your needs you might have to name the password-append.user.sh and the returned string (the OTP) will be appended to the saved password (from the keychain)

(more on available scripts: https://tunnelblick.net/cUsingScripts.html)

Goes without saying, but you need to have 1Password CLI installed and configured for this to work. (https://1password.com/downloads/command-line/)
Hope it can be of help to some of you!