Wiki · Integrations
Password managers
Hermes handles two kinds of secrets and people mix them up. Website logins go to the vault; API keys to a vault or .env.
.env or are read from 1Password / Bitwarden at every start. The first is
convenience, the second is hygiene.1. The login vault (built in)
When the agent hits a sign-in page it has no login for, it asks you — in a masked field. The password is stored encrypted on this machine, bound to one origin, and filled straight into the page. The model never sees it; it sees “filled 1 field”.
| Where to manage it | How |
|---|---|
| Desktop | Settings → Passwords & Logins (add, remove, unlock a manager) |
| Terminal | hermes vault list, hermes vault add |
| Turning a detected manager off | hermes vault sources --disable bitwarden |
Two-factor codes
| 2FA type | What Hermes does |
|---|---|
Authenticator key (setup key, otpauth://) | Generates the code and enters it — nobody is asked (the item shows a 2FA auto badge) |
| Code sent to phone or e-mail | Shows a small “Verification code for …” prompt, you type it, the agent enters it. The code never enters the chat |
| Passkey, hardware key, app approval | Nothing to type — the agent waits for you to finish on your device |
Cards and addresses
Stored the same way as logins and filled only on the site they belong to. Every card fill asks you first (the same approval as a dangerous command); headless sessions (cron, webhooks) cannot fill a card at all. Address fills need no confirmation.
2. Already using 1Password or Bitwarden?
Nothing to enable. With op or bw installed and signed in, Hermes finds it and
its website logins become fillable alongside local ones. The first time it needs one, it asks you to
unlock the manager with your master password (masked, once per session, re-locked after 30 idle minutes).
The agent never sees the master password or the session token — only that the field was filled.
3. API keys from a vault instead of .env
On every start (CLI, gateway, cron) Hermes runs op read and puts the values into the
environment. Rotating a key is then one change in 1Password — every process picks it up on next start.
If op is missing or the vault is locked, Hermes logs a warning and carries on with whatever
.env had; it never blocks startup.
| Option | When it helps |
|---|---|
override_existing: true (default) | The vault is the source of truth; .env is only a fallback |
override_existing: false | You want .env to win |
cache_ttl_seconds: 0 | Nothing is written to disk — safest, but every start calls op |
binary_path | Exact path to op; PATH is then not searched (protects against a planted binary) |
Bitwarden works the same way: BWS_ACCESS_TOKEN in .env and
bws secret list at startup. Servers use a machine account — no 2FA prompts
and read-only by design.
4. What to watch
| Situation | What to do |
|---|---|
| A secret in git or chat | It belongs in a vault; if it leaked, revoke and replace it |
| The agent keeps asking for the password | The login was not saved (“Don't save”), or the page redirects to a different origin |
| A card fill fails in the background | By design — a human must confirm |
| After changing a password the agent still uses the old one | Unlock the manager again or restart the session |