Sourcegraph - Update AccessToken schema

[marcleblanc2]

Overview

• Updated the schema, and doc links
• Added support for the new sgp_ v3 token format support
• Updated input validation rules to include capital hex chars A-F
• Endpoint now required

Type of change

• Created a new plugin
• Improved an existing plugin
• Fixed a bug in an existing plugin
• Improved contributor utilities or experience

Related Issue(s)

• None

How To Test

1. Create an account on https://sourcegraph.com/search
2. Go to your user settings and create an access token
3. Install src-cli
4. Run op plugin init src
5. Locate your Sourcegraph Access Token: Import into 1Password...
6. Enter or paste in the value of the Endpoint: Paste in https://sourcegraph.com
7. Enter or paste in the value of the Token: Paste in the access token created earlier
8. Run src login

$ src login
✔︎ Authenticated as <user> on <endpoint>

Entry created in 1Password desktop app:

Changelog

The Sourcegraph plugin now supports the current sgp_ access token format, and the Endpoint field is required since each token is tied to a specific endpoint.

[scottisloud]

Thanks for updating the Sourcegraph plugin schema and for the detailed manual test steps — the URL updates and making Endpoint required look right for how src authenticates today.

A few things I'd like to see before we merge, non-blocking, but ideally polish up if you deem it worthwhile:

• Token charset: Sourcegraph access tokens are hex-based and often include uppercase A–F (for example sgp_AaD80dc6E02eCAE1_d3cba16CC0F18fA14A2EFB61CbDFceEBf9fAD16b). The token field composition should include Uppercase: true in the charset, similar to plugins/github/personal_access_token.go.
• Token length: Length: 60 doesn't match the current v3 format (sgp_{16hex}_{40hex}, 61 characters total). Legacy tokens (sgp_{40hex}) are shorter. I'd drop the fixed length and rely on Prefix: "sgp_" plus the hex charset, or pick a length that matches the format you're targeting.
• Tests: access_token_test.go still uses a pre-sgp_ fixture. Please update the test token to a realistic sgp_-prefixed value so the tests match the schema.

nit: spacing in AlternativeNames: []string{"Website","URL"} for gofmt.

Could you also confirm make sourcegraph/validate and go test ./plugins/sourcegraph/... pass locally? I only see the signed-commits check on the PR so far.

Happy to take another look after those updates/you indicate no intent to make those optional updates.

(forgot to do this as a proper Review the first time 🤦 )

[marcleblanc2]

@scottisloud the ManagementURL hardcoded in the plugin schema

ManagementURL: sdk.URL("https://sourcegraph.com/settings/tokens"),

is more distracting than useful. Can we set the value based on the user's $SRC_ENDPOINT/settings/tokens?

I've filed issue #661 for this.

[marcleblanc2]

Hey @scottisloud,

Could you also confirm make sourcegraph/validate and go test ./plugins/sourcegraph/... pass locally?

Yes they do.

[2026-08-22 14:34:08] main % make sourcegraph/validate
# BETA NOTICE: The plugin ecosystem is in beta and is subject to change.
# You may have to update or recompile your local builds every now and then to keep them
# compatible with the 1Password CLI updates.

go run cmd/contrib/main.go sourcegraph/validate
# Plugin: sourcegraph

✔ Has plugin name set
✔ Plugin name only using lowercase characters or digits
✔ Plugin name not longer than 20 characters
✔ Has platform name set
✔ Has platform homepage URL set
✔ Has a credential type or executable defined
✔ Has no more than one credential type defined. Plugins with multiple credential types are not supported yet
✔ Credentials referenced in executables are included in the same plugin definition
✔ Credentials are uniquely identifiable inside a plugin

# Credential: Access Token

✔ Has name set
✔ Name is using title case
✔ Has documentation URL set
✔ Has management URL set
✔ Has at least 1 field
✔ All fields have name set
✔ All field names are using title case
✔ All fields have a description set
✔ All specified value compositions are valid
✔ Has at least 1 field that is secret
✔ Has no duplicate field names
✔ Has a provisioner set
✔ Has an importer set

# Executable: Sourcegraph CLI

✔ Has name set
✔ Has documentation URL set
✔ Has specified which commands need authentication
✔ Has executable command set
✔ Has a credential type defined
✔ Credential usage definitions are uniquely identifiable inside an executable

# Executable Sourcegraph CLI: Credential usage access_token

✔ If defined, a credential reference must have at least a `Name`
✔ If defined, a credential selection must have its `ID` and `IncludeAllCredentials` set
✔ Credential usage has either a credential reference or selection defined, but not both

[2026-08-22 14:37:04] main % go test -v ./plugins/sourcegraph/...         
=== RUN   TestAccessTokenProvisioner
=== RUN   TestAccessTokenProvisioner/default
--- PASS: TestAccessTokenProvisioner (0.00s)
    --- PASS: TestAccessTokenProvisioner/default (0.00s)
=== RUN   TestAccessTokenImporter
=== RUN   TestAccessTokenImporter/environment
--- PASS: TestAccessTokenImporter (0.00s)
    --- PASS: TestAccessTokenImporter/environment (0.00s)
PASS
ok      github.com/1Password/shell-plugins/plugins/sourcegraph  0.176s

[scottisloud]

Hi @marcleblanc2 thanks for circling back on this one!

I appreciate you raising the issue of the hardcoded ManagementURL and for the thoroughness of the issue you opened. Absolutely worth consideration, but I'll defer to the internal team that "owns" this repo (I've since moved teams) for how they would like to handle the substance of that issue, as their capacity permits.

All looks good, no outstanding issues. LGTM! I'll merge shortly assuming a clean workflow run.

[scottisloud]

Merged! These changes will appear in a future version of the 1Password CLI. Keep your eyes on the CLI Release notes, and I'll also make a best effort to circle back here when it's live and post an update.