Read a secret in CI with a 1Password Service Account token and the op CLI using secret references

Documented steps

1. In 1Password, go to Developer > Directory and create a Service Account (or run op service-account create), granting it only the specific vaults it needs with read_items permission.
2. Copy the generated token immediately - it is shown only once - and store it in your CI provider's encrypted secret store.
3. In the CI job install the 1Password CLI (op) and set the token: export OP_SERVICE_ACCOUNT_TOKEN="$CI_OP_TOKEN"
4. Verify the identity resolves: op service-account whoami
5. Build a secret reference URI of the form op://<vault-name>/<item-name>/[section-name/]<field-name>, e.g. op://prod/mysql/password
6. Read the value: op read "op://prod/mysql/password" - it prints to stdout, or use --out-file to write it to a file.
7. If the service account can reach more than one vault, item- and document-oriented commands (not op read) need an explicit --vault flag to disambiguate.
8. Capture the value into a masked CI variable rather than echoing it, so it never lands in build logs.
9. Make sure OP_CONNECT_HOST and OP_CONNECT_TOKEN are unset in the job, since Connect env vars take precedence over OP_SERVICE_ACCOUNT_TOKEN.
10. Official docs (verified 2026-07-29): https://www.1password.dev/cli/secret-references | https://developer.1password.com/docs/service-accounts/get-started