knot.secret
Pro
The knot.secret library reads the space owner’s personal secrets from 1Password, using the service account token stored on their profile. Secrets are read through the space’s agent, so they are only available to scripts running inside a space.
Execution Environment
| Environment | Behaviour |
|---|---|
Remote/space scripts (startup scripts), knot run-script, health check scripts |
Available. Reads go through the space’s agent and use the space owner’s token. |
| Scriptling using Knot as a plugin, inside a space | Available, through the plugin and the space’s agent. |
| MCP tool execution, event sink scripts, plugin handlers | Not available: get() raises an error. |
| External standalone, or anywhere outside a space | Not available: get() raises an error. |
A space whose template has Disable Personal Secrets turned on refuses every read. On Knot Core, get() reports that the server doesn’t support personal secrets.
Functions
| Function | Description |
|---|---|
get(path) |
Read a secret and return its value as a string |
get
get(path)path(str): The secret’s 1Password reference,op://vault/item/field, with the vault and item given by name or ID; a field inside a section isop://vault/item/section/field.
Raises an exception when no token is set on the owner’s profile, the owner lacks the Use Personal Secrets permission, the template or the space’s restrictions switch personal secrets off or don’t allow that reference, the reference isn’t a complete op://vault/item/field, or 1Password can’t return the secret.
Examples
import knot.secret
username = knot.secret.get("op://Knot/Database/username")
password = knot.secret.get("op://Knot/Database/password")
api_key = knot.secret.get("op://Knot/Stripe/API Keys/secret key")Handle a missing secret:
import knot.secret
try:
token = knot.secret.get("op://Knot/Deploy/token")
except Exception as e:
print("no deploy token:", e)The token itself is set in the Knot web interface; there is no function for it. See Personal Secrets.