Jon Aquino's Mental Garden

Engineering beautiful software jon aquino labs | personal blog

Friday, October 23, 2026

How to use your phone to "unlock" 1Password remotely on your laptop using a one-time passcode

Diagram showing the phone, laptop, Cloudflare Worker, and 1Password Sensitive vault

This is useful if you are working from your phone with an AI agent on your laptop and you want to let it access your 1Password secrets by giving an OTP to your AI agent.
  • Sensitive credentials live in a dedicated 1Password vault, accessible through a scoped service-account token.
  • That token is encrypted and stored behind a free Cloudflare Worker, with its decryption key kept on your laptop.
  • Your laptop also has an Ed25519 signing key, so another device cannot unlock access using an OTP alone.
  • You supply a fresh OTP when you want to enable access. You can send it to your AI agent from your phone.
  • Your laptop calls the Cloudflare Worker’s HTTPS API, sending an Ed25519-signed request and your fresh OTP. The Worker verifies both before returning the encrypted token.
  • A background helper on your laptop decrypts the token and holds it in RAM for up to one hour.
  • Your AI agent uses that helper for temporary access, without seeing the token itself.
  • For browser logins, credentials pass privately through the clipboard or clipboard bridge, without exposing their values to the agent.
  • Access closes automatically after an hour or manually when requested. 

0 Comments:

Post a Comment

<< Home