WSL gives you a Linux environment on Windows, but SSH authentication crosses an awkward boundary: Linux applications expect a Unix socket, while the 1Password agent on Windows listens on a Windows named pipe.

My 1Password-Bridge script connects those two interfaces. It uses socat and npiperelay.exe to expose the Windows agent at ~/.1password/agent.sock, so Ubuntu’s own ssh, ssh-add, and Git can use keys stored in 1Password.

This guide walks through that setup on Windows 11 with Ubuntu under WSL 2 and Bash. It focuses on SSH authentication; the bridge does not provide access to vault passwords or replace the separate 1Password CLI.

How the bridge works

The connection follows this path:

Ubuntu: /usr/bin/ssh or Git
        ↓ SSH_AUTH_SOCK
~/.1password/agent.sock
        ↓ socat
npiperelay.exe
        ↓ Windows named pipe
\\.\pipe\openssh-ssh-agent
        ↓
1Password for Windows

socat creates the Linux socket and passes agent traffic to npiperelay.exe. The relay communicates with the Windows named pipe. Ubuntu’s SSH client still makes the network connection and reads its Linux SSH configuration.

The script exports SSH_AUTH_SOCK so programs know where to find the agent. Its background listener uses fork to handle connections and setsid to run in a separate session. You can inspect this wiring in the bridge source; npiperelay’s upstream project documents the named-pipe transport.

Notes before we begin

This article focuses on the setting up WSL and 1Password so that native Linux binaries can access SSH keys in 1Password. You will still need to configure your SSH client to use Agent Forwarding in order to access from other hosts. That is outside the scope of this article, but Ill writing something up in the future.

1. Prepare WSL and Ubuntu

If you do not have Ubuntu installed, open PowerShell as administrator:

wsl --install -d Ubuntu

Restart if prompted, open Ubuntu, and create your Linux user account. In PowerShell, update WSL and check the distribution version:

wsl --update
wsl --list --verbose

Ubuntu should show version 2. For an existing WSL 1 installation, use wsl --set-version Ubuntu 2, substituting the listed distribution name if it differs. Microsoft documents the WSL installation process.

In Ubuntu, install the tools:

sudo apt update
sudo apt install socat openssh-client git curl util-linux procps

These supply the native SSH client, relay listener, download tool, and process utilities used by the script.

The socket is a communication endpoint, not a file containing your private keys. The 1Password agent performs authorized private-key operations for clients. See 1Password’s agent documentation.

2. Prepare 1Password on Windows

Install and sign in to the Windows 1Password desktop app. Create or import an SSH Key item in your Personal, Private, or Employee vault. For a new key, choose New Item → SSH Key → Add Private Key → Generate a New Key, select Ed25519, and save it. 1Password describes key creation and import.

The agent includes eligible keys from these built-in vaults by default. Shared or custom vaults require additional agent configuration.

Before enabling the 1Password agent, press Win + R, enter services.msc, and look for OpenSSH Authentication Agent. If it exists, stop it and set its startup type to Disabled. This lets 1Password own the standard Windows agent pipe; applications relying on the Windows service switch to the 1Password agent.

In 1Password, enable Settings → Developer → Use the SSH Agent. Also enable Keep 1Password in the notification area under General settings. These steps follow 1Password’s Windows setup instructions.

For GitHub, copy the item’s public key into Settings → SSH and GPG keys → New SSH key, choosing Authentication Key. For another server, register the public key with the account you connect to. Keep the private key in 1Password. GitHub documents public-key registration.

3. Put npiperelay.exe on your Windows drive

For a typical x64 Windows PC, download npiperelay_windows_amd64.zip from the albertony/npiperelay releases. This fork provides packaged Windows builds. Extract the archive and place npiperelay.exe in a directory of your choosing:

C:\npiperelay\npiperelay.exe

In Ubuntu, that location is:

/mnt/c/npiperelay/npiperelay.exe

The executable lives on Windows; the agent socket lives in your Linux home directory. Confirm that Ubuntu can see the executable:

ls -l /mnt/c/npiperelay/npiperelay.exe

Use a directory without spaces for this script’s current command construction. If you choose another drive or directory, use its corresponding WSL path in the next step.

4. Install and configure 1Password-Bridge

In Ubuntu, create a private directory for the socket:

mkdir -p "$HOME/.1password"
chmod 700 "$HOME/.1password"

Download the script into your home directory. If you already have a customized copy, preserve it before replacing it.

curl --fail --location \
  https://raw.githubusercontent.com/jimmychanga/1Password-Bridge/main/.1password-bridge.sh \
  --output "$HOME/.1password-bridge.sh"

Open it in your editor:

nano "$HOME/.1password-bridge.sh"

The repository currently uses this installation directory, customize it for where you install npiperelay:

WINDOWS_NPIPERELAY_INSTALL="/mnt/d/npiperelay/"

For the C:\npiperelay location above, change that line to:

WINDOWS_NPIPERELAY_INSTALL="/mnt/c/npiperelay/"

Keep the trailing slash: the script appends npiperelay.exe to this value. Its socket setting already points to:

export SSH_AUTH_SOCK=$HOME/.1password/agent.sock

Save the file. The repository README describes this home-directory installation and Bash integration.

5. Load the bridge in Bash

Add this line once to the end of Ubuntu’s ~/.bashrc, after any other agent setup:

source "$HOME/.1password-bridge.sh"

Then load it in your current terminal:

source "$HOME/.bashrc"

Source the file rather than running it with bash filename. Sourcing sets SSH_AUTH_SOCK in your current shell, where SSH and Git inherit it. Running it in a child shell does not update the parent shell’s environment.

You do not need sudo or executable permission to source this file. The bridge runs under your normal Linux user account.

This startup hook applies to interactive Bash sessions. An IDE, scheduled job, or other independently launched process needs the same SSH_AUTH_SOCK value and a running relay; editing .bashrc does not automatically update every process.

6. Remove Windows SSH overrides

If you use aliases such as alias ssh='ssh.exe', remove those lines from your shell startup files. Clear existing aliases in your current terminal:

unalias ssh 2>/dev/null
unalias ssh-add 2>/dev/null

Check what the commands resolve to:

type -a ssh ssh-add

You want Ubuntu’s /usr/bin/ssh and /usr/bin/ssh-add. A shell function or another wrapper can also override a command, so inspect any unexpected result.

Inside a Git repository, check for an existing SSH override:

git config --show-origin --get-all core.sshCommand

If your global configuration contains the earlier ssh.exe setting, remove it:

git config --global --unset-all core.sshCommand

Remove a repository-local Windows override with --local instead, only when the inspection shows one. Also check GIT_SSH and GIT_SSH_COMMAND if Git still launches Windows SSH. Preserve unrelated custom configuration. Git documents these SSH command overrides.

7. Verify the socket and native SSH connection

In Ubuntu, check the environment and socket:

printf '%s\n' "$SSH_AUTH_SOCK"
test -S "$SSH_AUTH_SOCK" && echo "Agent socket exists"
/usr/bin/ssh-add -l

The first command should show /home/YOUR-LINUX-USER/.1password/agent.sock. The last should list key fingerprints from 1Password. A socket file alone does not prove the relay works; listing keys tests communication through it.

Now test a real authentication request:

/usr/bin/ssh -T git@github.com

Approve the 1Password request on Windows. On a first connection, compare the host fingerprint with GitHub’s published fingerprints before accepting it.

A successful GitHub response names your account and explains that shell access is unavailable. Exit code 1 is normal for this particular test. See GitHub’s connection-test documentation.

Using /usr/bin/ssh explicitly proves the Linux client works even if a leftover alias exists.

For Git, use an SSH remote. Inside your repository:

git remote -v

If necessary, replace an HTTPS origin, substituting your repository details:

git remote set-url origin git@github.com:OWNER/REPOSITORY.git
git fetch

HTTPS authentication does not use this agent socket. GitHub explains changing remote URLs.

Now all native Linux application running in WSL like Mosh have access to your 1Password SSH keys.

Troubleshooting

The socket exists, but SSH cannot reach the agent

Check that the relay executable is at the configured path, 1Password is running, and its SSH agent is enabled. Inspect the listener:

pgrep -af 'socat.*agent.sock'

The script suppresses background output, so a startup message does not confirm successful startup. Its process checks also do not provide service supervision or locking between simultaneous shell launches.

For a clean restart, save work in all WSL sessions and run wsl --shutdown in PowerShell. This stops all WSL distributions and their processes. Reopen Ubuntu to load the bridge again. Microsoft documents WSL shutdown.

The agent has no identities

An empty key list differs from an unreachable agent. OpenSSH returns 1 for a failed operation and 2 when it cannot contact the agent. The current bridge script treats every nonzero result from ssh-add -l as a reason to restart relay processes. Check key availability in 1Password before assuming the transport fails. See the script and OpenSSH’s exit-status documentation.

SSH uses the wrong socket or key

Native SSH reads Ubuntu’s ~/.ssh/config. An existing IdentityAgent setting can override SSH_AUTH_SOCK. Inspect the effective configuration:

/usr/bin/ssh -G github.com | grep -Ei 'identityagent|identityfile|identitiesonly'

Remove or update a conflicting agent setting. OpenSSH documents IdentityAgent precedence.

If too many keys cause authentication failures, save the selected key’s public half as ~/.ssh/github-1password.pub and add this to Ubuntu’s SSH config:

Host github.com
    User git
    IdentityFile ~/.ssh/github-1password.pub
    IdentitiesOnly yes

The public file selects the identity; 1Password performs the private-key operation. See 1Password’s host-specific key guidance.

Windows executables do not launch from Ubuntu

The bridge still needs WSL interoperability to run npiperelay.exe. Check /etc/wsl.conf for an [interop] section with enabled=false; enable it while preserving the other settings, then restart WSL after saving work. Because the script uses an explicit executable path, it does not require Windows directories in Linux’s PATH. Microsoft documents these interoperability settings.

With the bridge running, Ubuntu has the interface its SSH tools expect: a Unix agent socket. Your SSH configuration stays in Linux, your keys stay in 1Password, and the relay carries authentication requests between them.