Repository navigation
Extension should provide a command to retrieve a secret's actual value. #222
Description
Summary
A command to retrieve a secret's value as a string is a useful addition to the features provided.
Use cases
A debug process may require the a secret value as an environment variable or application parameter. The extension should support the injection of secrets directly from 1Password, avoiding the need to compromise security by providing secrets at rest in launch.json or .env files.
Proposed solution
The proposed getValueFromReference command would support the strategies outlined in VS Code documentation and make it possible to declare inputs that securely provide secret values (the existing getValueFromItem command, in its default "use reference" mode, is appropriate for setting up the input declaration).
Is there a workaround to accomplish this today?
I am not aware of any such workaround.
References & Prior Work
- [https://code.visualstudio.com/docs/reference/variables-reference#_input-variables]
Activity
mjec commentedon Nov 1, 2025
I would also find this useful. My particular use case involves injecting a secret into the environment for a task running on a remote host without having to give that host direct access to the secret (I don't want to store e.g. a service account key on the host).
DiamondJoseph commentedon Aug 25, 2026
Another voice in support of this, ideally I could have a devcontainer like so:
{ "build": { // Installs `op` CLI tool - or ideally, an official supported feature! "dockerfile": "Dockerfile" }, "customizations": { "vscode": { "extensions": [ "1Password.op-vscode" ] } } }and a tasks.json like so:
{ "version": "2.0.0", "tasks": [ { "label": "Print secret", "type": "shell", "command": "echo ${input:secret}", "problemMatcher": [], } ], "inputs": [ { "id": "secret", "type": "command", "command": "op-vscode.getValueFromReference", "args": { "ref": "op://vault/item/field" } } ] }A developer could check out the project, build and open the devcontainer, sign into 1Password, and then have access to run the task.
Right now,
getValueFromItemseems to force going through the UI to pick the name of the component to be read, and does not accept the secretRef form.