FiloSottile / FiloSottile/age

Docs: example workflow for storing age identities in a password manager (Bitwarden / 1Password / etc.)

Open Beginner friendly
#722 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
Go
Stars
23.6k
Forks
670
Avg merge
39m
Merged PRs (30d)
1

Description

@
## Version

age v1.3.1.

## Problem

A common real-world setup is to keep the age identity (`AGE-SECRET-KEY-1...`) inside a password-manager vault (Bitwarden, 1Password, KeePassXC, pass) rather than on disk. This is the recommended approach for anyone using age to encrypt secrets in a git repo (sops+age, git-crypt-alike workflows, `.env.enc` patterns), because the identity file itself must not be checked in and putting it in the vault gives you cross-device sync + backup + audit trail for free.

There is no documentation of this pattern anywhere in the age README, wiki, or man page, so every team reinvents it — usually by copy-pasting the key into a "secure note" and then hand-rolling a shell one-liner to pipe it into `age -d -i -`.

## Suggestion

Add a short "Storing identities" section (README or a `docs/` page) covering the two common shapes:

1. **Ephemeral pipe from the vault** — retrieve the secret from the manager CLI and pipe it in as `-i -`:
```bash
# Bitwarden
bw get notes age-identity | age -d -i - secret.age

# 1Password
op read "op://Personal/age/identity" | age -d -i - secret.age

# pass
pass show age/identity | age -d -i - secret.age
```
2. **Materialise to a temp file** for tools (like sops) that require a real path — `mktemp`, write, `chmod 600`, use, `shred`/`rm` on exit. Show the trap-based cleanup pattern.

Both patterns work today with the existing `-i -` support; this is purely a documentation ask, no code change.

## Why this is worth adding

- Reduces the "put the age key in a synced folder" foot-gun (see companion issue about Windows key locations).
- Gives sops+age users a citable pattern instead of folk knowledge.
- Costs the project nothing to maintain — the CLI already supports `-i -`.

Happy to open a docs PR if the maintainers are receptive.
@

Contributor guide

Open the contributing guide

Research direction

Start by checking the README, wiki, and man page for existing documentation of the `-i -` option and choose the project's current documentation home. Add the two identity-storage patterns from the issue, including the Bitwarden, 1Password, and pass examples and temporary-file cleanup. Done means the workflow is documented without code changes and the commands match the existing CLI behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
shell
Domain
cli, documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
Half a day
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.