---
title: 1Password and GitHub
description: The two logins everything else builds on, an SSH key in 1Password, signed commits, and the GitHub CLI.
---

1Password holds every secret dot uses: SSH keys and API tokens. The private
key never leaves 1Password and is used after Touch ID. Every item dot
creates or uses (not your logins) is tagged `dotfiles`, so
`op item list --tags dotfiles` shows them all.

One SSH key does two jobs:

- **Authentication:** `git push` and `git pull` to GitHub.
- **Commit signing:** GitHub shows your commits as *Verified*.

The app and its CLI, `op`, come from `dot apply`. The first steps are yours,
because they involve your account.

## 1. Sign in and turn on the developer features

Open 1Password, sign in, and in **Settings → Developer** turn on:

- **Use the SSH agent:** SSH and git get keys from 1Password.
- **Integrate with 1Password CLI:** `op` uses the app's session and Touch ID.

If 1Password offers to update `~/.ssh/config`, either answer works; dot adds
the same block if it's missing. To check:

```sh
op vault list    # Touch ID, then your vaults
ls ~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock
```

The second command must print the path: that file is the agent's socket.

## 2. Create an SSH key

An **Ed25519** key, in your **built-in personal vault**: "Personal" on
individual and family accounts, "Private" on business ones. By default the
SSH agent only offers keys from that vault, and `op` uses it when no
`--vault` is given. Tag it `dotfiles`. One key per Mac is fine; GitHub
accepts several.

- **In the app:** *+ New Item → SSH Key → Add Private Key → Generate a New
  Key → Ed25519*. Title it `GitHub` and add the tag `dotfiles`.
- **In the terminal:**

  ```sh
  op item create --category "SSH Key" --title "GitHub" --tags dotfiles --ssh-generate-key ed25519
  ```

  The CLI can't edit SSH keys yet, so to tag an existing key, edit it in the
  app.

## 3. Log in to GitHub

Connect the GitHub CLI, `gh`, to a token in 1Password, so no token is ever
saved on disk: [GitHub](/docs/your-projects/accounts/github). It
takes about ten minutes once, and under a minute on each later Mac.

## 4. Use the key

In `dot.toml`, `ssh_key` is the key's **title** in 1Password, and `user`
under `[github]` your GitHub username:

```toml
ssh_key = "GitHub"

[github]
user = "your-username"
```

```sh
dot apply ssh       # ssh agent 1password
dot apply git       # git signing-key $ssh_key
dot apply github    # github ssh-key $github.user $ssh_key
```

- **`ssh agent 1password`** adds a `Host *` block to `~/.ssh/config` that
  points at the agent. The rest of the file stays yours.
- **`git signing-key`** makes git sign every commit and tag with the key
  (`op-ssh-sign`), and writes `~/.config/git/allowed_signers` so git can
  verify signatures locally.
- **`github ssh-key`** adds the public key to your GitHub account twice, as
  an authentication key and as a signing key, titled after the hostname.

`dot check` needs no Touch ID: the public key comes from the agent, and
GitHub's public key lists show what your account has. Signing a commit asks
for Touch ID, and so does `dot apply github`, which adds keys through `gh`.

## 5. Check it

```sh
ssh -T git@github.com            # "Hi <you>! You've successfully authenticated"
git log --show-signature -1      # in a repo with a new commit: Good "git" signature
dot auth status                  # every login dot uses
```

Commits made before signing was on aren't signed. If they aren't pushed
yet, `git rebase --root --force-rebase` re-signs them.