loadSecret

Fills a credential resolved just-in-time from a configured 1Password integration into a target input. The resolved value never appears in your query or in the response. The session must be started with an integration (the integrationId connection parameter or session field), and the page's origin must be in the integration's allowed-domain list. Once any secret has been filled, capture and page-content readback are disabled for the rest of the session — screenshots, PDFs, screencasts, Live URLs, session recording, and the content-return mutations (evaluate, html, text, querySelector, querySelectorAll, cookies).

**Usage Example:**

mutation Login {
  goto(url: "https://example.com/login") {
    status
  }

  username: loadSecret(
    ref: "op://Vault/Item/username"
    selector: "#email"
  ) {
    ok
    error
  }

  password: loadSecret(
    ref: "op://Vault/Item/password"
    selector: "#password"
  ) {
    ok
    error
  }
}

**Field Definition:**

loadSecret(
  ref: String!
  selector: String
): LoadSecretResponse

Arguments

loadSecret.ref ● String! non-null scalar

The 1Password op:// reference (e.g. op://Vault/Item/password), or an alias declared in the session's credentials map.

Also accepts a mail://<vault>/<item>/otp reference to resolve the newest emailed one-time code server-side (the value is never surfaced). The named 1Password Login item holds the inbox's own IMAP credentials: username (inbox address) and password (an app-password), with optional host/port fields overriding the imap.gmail.com:993 default for other IMAP providers. Options: ?wait= (ms, default 45000, clamped 5000-120000), ?from= (sender substring filter), ?pattern= (custom extraction regex). Only a message that arrives AFTER the call is accepted, so trigger the send and then call loadSecret promptly, and open the session with ?timeout= above the wait budget. Returns OtpTimeout if no fresh code arrives in the window.

loadSecret.selector ● String scalar

The CSS selector of the input to fill. If omitted, the currently focused element is used.

Type

LoadSecretResponse object

Response returned after attempting to fill a credential resolved from a 1Password integration. The resolved value is never included in the response.