Resolve 1Password secrets programmatically with the JavaScript SDK using a Service Account token

Documented steps

1. Create a service account scoped to only the vaults the application needs. It cannot access Personal, Private, Employee or the default Shared vault.
2. Store the token securely and expose it at runtime as OP_SERVICE_ACCOUNT_TOKEN; never hardcode it in source.
3. Install the SDK: npm install @1password/sdk
4. Import it: import sdk from "@1password/sdk";
5. Create an authenticated client: const client = await sdk.createClient({ auth: process.env.OP_SERVICE_ACCOUNT_TOKEN, integrationName: "My 1Password Integration", integrationVersion: "v1.0.0" });
6. Resolve a secret by reference: const secret = await client.secrets.resolve("op://Tutorial/API Credential/credential"); the plaintext exists in memory only.
7. For many secrets, prefer the SDK's bulk resolve-all method over looping single resolves, to cut round trips.
8. To create, update or delete items rather than only read them, use the SDK's items API; the service account also needs write_items permission on the vault.
9. Never log the resolved value; hold it only for as long as the consuming call (e.g. opening a DB connection) requires.
10. Official docs (verified 2026-07-29): https://www.1password.dev/sdks/setup-tutorial | https://developer.1password.com/docs/sdks/load-secrets/
11. Note: integrationName and integrationVersion are required client metadata, not optional labels - omitting them fails client creation.