Module access 

Read access to a 1Password account: log in with the master password and Secret Key, then download and decrypt every accessible vault into a native 1Password model.

A port of the OnePassword module in Bitwarden’s C# password-manager-access library. See README.md for the porting notes and open questions.

Re-exports

pub use client::Client;

pub use credentials::Credentials;

pub use device::generate_device_uuid;

pub use error::OnePasswordError;

pub use sign_in::SignInAddress;

pub use sign_in::SignInDomain;

pub use two_factor::TotpResult;

pub use two_factor::TwoFactorUi;

Modules

account_key 🔒

Account Key (Secret Key): A2/A3 parse, HKDF-SHA256 hash, and XOR combine.

client 🔒

The entry point: log in, unlock the account’s keys, download its vaults.

credentials 🔒

The credentials a password login needs.

device 🔒

The device identity presented to 1Password and its registration.

error 🔒

Error type for the 1Password client.

identity 🔒

The 1Password client this module impersonates.

kdf 🔒

HKDF-SHA256, PBES2 (PBKDF2-HS256), and master-key derivation.

keychain 🔒

Key store keyed by kid, scheme dispatch, and keyset topological decrypt.

login 🔒

The password + Secret Key login state machine.

mac 🔒

X-AgileBits-MAC request signer.

model

What a download yields: vaults holding items, each item still in its decrypted 1Password shape.

opdata 🔒

AES-256-GCM “opdata” envelope with the tag appended after the ciphertext.

rest 🔒

reqwest wrapper: identity headers, the MAC signing hook, encrypted GET/POST, and error parsing.

rsa 🔒

RSA-OAEP (SHA1/SHA256) decrypt from 1Password’s JWK.

session 🔒

The signed channel a completed login leaves behind.

sign_in 🔒

The sign-in address an account lives at: its subdomain and one of 1Password’s domains.

srp 🔒

SRP-4096: the A/B exchange with the server and the crypto behind it.

two_factor 🔒

Two-factor authentication: the callback the caller implements and the TOTP exchange that drives it.

wire

serde DTOs for every 1Password endpoint.