@distilled.cloud/onepassword

Effect-native 1Password SDK, generated from 1Password's published OpenAPI specs: Connect, Events, Users, OAuth and Partnership.

Installation

npm install @distilled.cloud/onepassword effect

APIs

Each API is a service namespace with its own credentials layer and protocol. A service is also importable on its own, e.g. @distilled.cloud/onepassword/connect.

Quick start

Connect (a self-hosted Connect server):

import { Effect, Layer } from "effect";
import * as FetchHttpClient from "effect/http/FetchHttpClient";
import * as Onepassword from "@distilled.cloud/onepassword";

const program = Effect.gen(function* () {
  const vaults = yield* Onepassword.connect.getVaults({});
  return vaults;
});

const Live = Layer.mergeAll(
  FetchHttpClient.layer,
  Onepassword.ConnectCredentialsFromEnv,
  Onepassword.ConnectProtocol,
);

program.pipe(Effect.provide(Live), Effect.runPromise);

Events (audit events from an Events Reporting integration):

import { Effect, Layer } from "effect";
import * as FetchHttpClient from "effect/http/FetchHttpClient";
import * as Onepassword from "@distilled.cloud/onepassword";

const program = Effect.gen(function* () {
  // Start a cursor with a page size and a start time, then pass the returned
  // `cursor` back as `{ body: { cursor } }` to continue.
  const page = yield* Onepassword.events.getAuditEventsV2({
    body: { limit: 100, start_time: "2026-10-01T00:00:00Z" },
  });
  return page.items;
});

const Live = Layer.mergeAll(
  FetchHttpClient.layer,
  Onepassword.EventsCredentialsFromEnv,
  Onepassword.EventsProtocol,
);

program.pipe(Effect.provide(Live), Effect.runPromise);

Users (suspend a user; the access token is requested and refreshed for you):

import { Effect, Layer } from "effect";
import * as FetchHttpClient from "effect/http/FetchHttpClient";
import * as Onepassword from "@distilled.cloud/onepassword";

const program = Onepassword.users.suspendUser({
  account: "ABCDEFGHIJKLMNOPQRSTUVWXYZ",
  user: "ZYXWVUTSRQPONMLKJIHGFEDCBA",
});

const Live = Layer.mergeAll(
  FetchHttpClient.layer,
  Onepassword.UsersCredentialsFromEnv,
  Onepassword.UsersProtocol,
);

program.pipe(Effect.provide(Live), Effect.runPromise);

Auth

1Password publishes no environment variable names for the Events, Users or Partnership APIs; the names above are this SDK's. Accounts outside the US use a regional host: *.1password.ca, *.1password.eu or *.ent.1password.com.

The Users credentials exchange the OAuth application's client ID and secret for a 15-minute access token at POST /v1/oauth/token, cache it, and request a new one shortly before it expires. To pass values directly, use connectCredentials({ token }), eventsCredentials({ token }), usersCredentials({ clientId, clientSecret }), usersCredentialsFromAccessToken({ accessToken }), oauthCredentials(...) or partnershipCredentials({ token }); secrets are Redacted<string>.