Docs: example workflow for storing age identities in a password manager (Bitwarden / 1Password / etc.)
- Dominant language
- Go
- Stars
- 23.6k
- Forks
- 670
- Avg merge
- 39m
- Merged PRs (30d)
- 1
Description
@
## Version
age v1.3.1.
## Problem
A common real-world setup is to keep the age identity (`AGE-SECRET-KEY-1...`) inside a password-manager vault (Bitwarden, 1Password, KeePassXC, pass) rather than on disk. This is the recommended approach for anyone using age to encrypt secrets in a git repo (sops+age, git-crypt-alike workflows, `.env.enc` patterns), because the identity file itself must not be checked in and putting it in the vault gives you cross-device sync + backup + audit trail for free.
There is no documentation of this pattern anywhere in the age README, wiki, or man page, so every team reinvents it — usually by copy-pasting the key into a "secure note" and then hand-rolling a shell one-liner to pipe it into `age -d -i -`.
## Suggestion
Add a short "Storing identities" section (README or a `docs/` page) covering the two common shapes:
1. **Ephemeral pipe from the vault** — retrieve the secret from the manager CLI and pipe it in as `-i -`:
```bash
# Bitwarden
bw get notes age-identity | age -d -i - secret.age
# 1Password
op read "op://Personal/age/identity" | age -d -i - secret.age
# pass
pass show age/identity | age -d -i - secret.age
```
2. **Materialise to a temp file** for tools (like sops) that require a real path — `mktemp`, write, `chmod 600`, use, `shred`/`rm` on exit. Show the trap-based cleanup pattern.
Both patterns work today with the existing `-i -` support; this is purely a documentation ask, no code change.
## Why this is worth adding
- Reduces the "put the age key in a synced folder" foot-gun (see companion issue about Windows key locations).
- Gives sops+age users a citable pattern instead of folk knowledge.
- Costs the project nothing to maintain — the CLI already supports `-i -`.
Happy to open a docs PR if the maintainers are receptive.
@
Contributor guide
Research direction
Start by checking the README, wiki, and man page for existing documentation of the `-i -` option and choose the project's current documentation home. Add the two identity-storage patterns from the issue, including the Bitwarden, 1Password, and pass examples and temporary-file cleanup. Done means the workflow is documented without code changes and the commands match the existing CLI behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- shell
- Domain
- cli, documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- Half a day
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100