1Password CLI Monitoring with Vigilmon

1Password is widely used by development teams not only as a password manager but as a secrets automation platform. The 1Password CLI (op), Secrets Automation (Connect), and the 1Password SDKs allow teams to inject secrets into applications, CI/CD pipelines, shell scripts, Docker containers, and Kubernetes workloads — without secrets ever touching plaintext configuration files.

As with any infrastructure that application deployments depend on, the 1Password secrets layer must be monitored. A Connect server that is down, a service account token that has expired, or a 1Password.com API outage can silently break deployments, cause applications to start with missing credentials, or prevent secret rotation from completing.

This guide covers how to monitor 1Password CLI and Secrets Automation infrastructure using Vigilmon.

Why 1Password CLI Infrastructure Needs Monitoring

1Password automation can fail in several ways that are not immediately obvious:

• Connect server unavailability — the self-hosted Connect server is down or unreachable; all op read calls from applications and scripts fail silently or with confusing errors
• Service account token expiry — op tokens expire on a set schedule; automated scripts start returning authentication errors without clear messaging
• Vault permission changes — an operator removes or restricts a service account's vault access; dependent pipelines break at the next secret retrieval
• 1Password.com API availability — when using cloud-based Secrets Automation, a 1Password API outage blocks all secret reads across connected applications
• Connect server TLS certificate expiry — the self-hosted Connect server's TLS certificate expires; clients that enforce certificate validation fail all requests
• Secret reference resolution failures — op inject or op run templates that reference renamed or deleted items silently produce empty values

Each of these failure modes can block deployments or cause security gaps. Vigilmon gives you proactive alerting before they affect production.

1Password Infrastructure Components

| Component | What It Does | Monitoring Priority | |-----------|-------------|---------------------| | 1Password.com API | Cloud vault access | High | | 1Password Connect server | Self-hosted secret proxy | Critical | | Service account tokens | Authenticate op calls | High | | op CLI | Developer and CI secret injection | Medium | | 1Password SDKs | Application-level secret reads | High |

Monitoring the 1Password Connect Server

Monitor 1: Connect Server Health Endpoint

The Connect server exposes a health endpoint at /heartbeat:

1. Log in to Vigilmon → Monitors → New Monitor
2. Type: HTTP
3. Name: 1Password Connect Server - Health
4. URL: https://connect.your-domain.com/heartbeat
5. Method: GET
6. Expected status: 200
7. Interval: 1 minute

Also monitor the full /v1/vaults endpoint to verify the Connect token is valid (not just that the process is running):

# Test the Connect server with a real API call
curl -s \
  -H "Authorization: Bearer $OP_CONNECT_TOKEN" \
  "https://connect.your-domain.com/v1/vaults" | jq '. | length'

In Vigilmon:

• Type: HTTP
• Name: 1Password Connect - Vault Access
• URL: https://connect.your-domain.com/v1/vaults
• Method: GET
• Request headers: Authorization: Bearer YOUR_CONNECT_TOKEN
• Expected status: 200
• Keyword check: "id": (any vault object in the response)
• Interval: 5 minutes

Monitor 2: Connect Server TLS Certificate

Add a separate monitor to track the Connect server's TLS certificate before it expires:

1. Type: HTTP
2. Name: 1Password Connect - TLS Certificate
3. URL: https://connect.your-domain.com/heartbeat
4. SSL certificate expiry alert: 30 days before expiry
5. Interval: 1 hour

Monitoring 1Password.com Service Availability

1. Type: HTTP
2. Name: 1Password Cloud API
3. URL: https://status.1password.com/api/v2/status.json
4. Method: GET
5. Expected status: 200
6. Keyword check: "indicator":"none"
7. Interval: 5 minutes

Monitoring Secret Injection Pipelines

Pattern 1: Shell Script with op run

#!/bin/bash
# deploy-with-secrets.sh
set -euo pipefail

# Use op run to inject secrets via environment references
op run --env-file=".env.tpl" -- ./deploy.sh

DEPLOY_EXIT=$?

if [ $DEPLOY_EXIT -eq 0 ]; then
  curl -s "https://heartbeat.vigilmon.online/$VIGILMON_DEPLOY_HEARTBEAT_ID"
else
  echo "[1password] secret injection or deployment failed with exit $DEPLOY_EXIT"
  exit $DEPLOY_EXIT
fi

The .env.tpl file uses 1Password secret references:

# .env.tpl
DATABASE_URL=op://Production/postgres/connection-string
API_KEY=op://Production/stripe/secret-key

Pattern 2: CI/CD Secret Injection

# .github/workflows/deploy.yml
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Install 1Password CLI
        uses: 1password/install-cli-action@v1

      - name: Load secrets
        uses: 1password/load-secrets-action@v2
        with:
          export-env: true
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          DATABASE_URL: op://Production/postgres/connection-string
          STRIPE_SECRET_KEY: op://Production/stripe/secret-key

      - name: Signal secret load success
        run: |
          curl -s "https://heartbeat.vigilmon.online/${{ secrets.VIGILMON_HEARTBEAT_ID }}"

      - name: Deploy
        run: ./deploy.sh

In Vigilmon:

• Type: Heartbeat
• Name: 1Password - CI/CD Secret Injection
• Expected interval: Matches your CI/CD cadence (e.g., 1 hour for frequent deploys)
• Grace period: 30 minutes

Pattern 3: Docker Compose with op run

# docker-compose.yml
services:
  app:
    image: your-app:latest
    env_file:
      - .env.injected   # generated by op inject before docker compose up

#!/bin/bash
# start.sh
set -euo pipefail

# Inject secrets into .env file
op inject -i .env.tpl -o .env.injected

if [ ! -s .env.injected ]; then
  echo "[1password] secret injection produced empty file"
  curl -s "https://heartbeat.vigilmon.online/$VIGILMON_INJECT_FAILURE_ID?status=fail"
  exit 1
fi

curl -s "https://heartbeat.vigilmon.online/$VIGILMON_INJECT_SUCCESS_ID"
docker compose up -d

Service Account Token Rotation Monitoring

Service account tokens expire after a configured duration. Monitor that rotation jobs succeed on schedule:

#!/bin/bash
# rotate-op-token.sh — run on a schedule before token expiry
set -euo pipefail

# Test the current token still works
VAULTS=$(op vault list --format=json 2>/dev/null | jq '. | length')

if [ -z "$VAULTS" ] || [ "$VAULTS" -eq 0 ]; then
  echo "[op] service account token appears invalid or expired"
  exit 1
fi

echo "[op] service account token valid, vault count: $VAULTS"
curl -s "https://heartbeat.vigilmon.online/$VIGILMON_TOKEN_HEALTH_HEARTBEAT_ID"

In Vigilmon:

• Type: Heartbeat
• Name: 1Password - Service Account Token Health
• Expected interval: 24 hours (run daily as a cron job)
• Grace period: 2 hours

Application SDK Health Check

For applications using the 1Password SDK directly:

# health.py
import os
import onepassword

async def check_op_health():
    client = await onepassword.Client.authenticate(
        auth=os.environ["OP_SERVICE_ACCOUNT_TOKEN"],
        integration_name="health-check",
        integration_version="1.0.0",
    )

    # Read the dedicated health-check secret
    value = await client.secrets.resolve("op://Health/vigilmon-check/value")

    if value != "ok":
        raise RuntimeError(f"Unexpected health check value: {value}")

    return True

# Run as a FastAPI health endpoint
from fastapi import FastAPI, HTTPException
import httpx

app = FastAPI()

@app.get("/health/secrets")
async def secrets_health():
    try:
        ok = await check_op_health()
        return {"status": "ok", "secrets": "accessible"}
    except Exception as e:
        raise HTTPException(status_code=503, detail=str(e))

Monitor the /health/secrets endpoint in Vigilmon with a 1-minute interval. This surfaces 1Password connectivity failures as a 503 response on your application's health page.

Kubernetes Integration Monitoring

For teams using the 1Password Kubernetes Operator:

# OnePasswordItem resource health check
apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
  name: health-check-secret
  namespace: monitoring
spec:
  itemPath: "vaults/Production/items/health-check"

Add a CronJob that verifies the operator is syncing secrets:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: op-operator-health
  namespace: monitoring
spec:
  schedule: "*/15 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: check
              image: curlimages/curl:latest
              command:
                - sh
                - -c
                - |
                  VALUE=$(cat /secret/value)
                  if [ "$VALUE" = "ok" ]; then
                    curl -s "$VIGILMON_HEARTBEAT_URL"
                  else
                    exit 1
                  fi
              env:
                - name: VIGILMON_HEARTBEAT_URL
                  value: "https://heartbeat.vigilmon.online/YOUR_HEARTBEAT_ID"
              volumeMounts:
                - name: health-secret
                  mountPath: /secret
          volumes:
            - name: health-secret
              secret:
                secretName: health-check-secret
          restartPolicy: Never

In Vigilmon:

• Type: Heartbeat
• Name: 1Password Kubernetes Operator
• Expected interval: 15 minutes
• Grace period: 5 minutes

Alert Configuration

| Monitor | Type | Interval | Alert Channel | |---------|------|----------|---------------| | Connect server health | HTTP | 1 min | PagerDuty + Slack | | Connect vault access | HTTP | 5 min | PagerDuty | | Connect TLS certificate | HTTP | 1 hour | Email + Slack | | 1Password Cloud API | HTTP | 5 min | Slack | | CI/CD secret injection | Heartbeat | 1 hour | Slack | | Service account token | Heartbeat | 24 hours | Email + Slack | | Kubernetes operator | Heartbeat | 15 min | Slack |

Status Page for Secrets Infrastructure

1. Status Pages → New Page → name it "1Password Secrets Infrastructure"
2. Add all monitors above
3. Share with platform engineering and security teams

This page gives your team a single place to check during deployment failures that may be caused by secret access issues.

Summary

1Password CLI and Secrets Automation are powerful tools for eliminating plaintext secrets from your infrastructure. Vigilmon ensures the secrets layer itself remains healthy:

• HTTP monitors for Connect server health, TLS certificates, and 1Password Cloud status
• Heartbeat monitors for CI/CD secret injection pipelines, SDK health checks, and token rotation jobs
• Alert routing to PagerDuty for Connect server outages that block all deployments
• Status pages for organization-wide secrets infrastructure visibility

Get started at vigilmon.online.