Signing a commit proves it actually came from you and gets you the "Verified" badge on GitHub, GitLab, and Bitbucket. Since Git 2.34, you can sign with an SSH key instead of GPG. And 1Password can handle the signing for you without your private key ever touching disk.
Prerequisites
- Git 2.34+ (git --version)
- 1Password, with the SSH agent turned on (check 1Password's SSH agent guide)
- An SSH key saved in your 1Password vault
1. Configure Git
Easiest:
-
Open the SSH key in 1Password
-
Click the
⋮(3 vertical dots) on top right -
Click "Configure Commit Signing"
-
Copy the snippet into your
.gitconfig.
Manual:
git config --global gpg.format ssh
git config --global commit.gpgsign true
git config --global user.signingkey "ssh-ed25519 AAAA...your-public-key..."
git config --global gpg.ssh.program "<path-to-op-ssh-sign>"
| OS | op-ssh-sign path |
|---|---|
| macOS | /Applications/1Password.app/Contents/MacOS/op-ssh-sign |
| Windows | %LOCALAPPDATA%\1Password\app\8\op-ssh-sign.exe |
| Linux | /opt/1Password/op-ssh-sign |
(Remove --global flag from above commands to scope commit signing to single repo.)
2. Register the key with your Git host
Add the same public key again in your host's SSH key settings (e.g., GitHub → Settings → SSH and GPG keys → New SSH key), but set Key type to Signing Key not the Authentication key.
3. Test it
git commit --allow-empty -m "test signed commit"
git log --show-signature -1
Push and check for the Verified badge on Github/Gitlab/Bitbucket.
GUI clients (Fork, SourceTree etc.)
Desktop git apps use your system's git config, so commits made through the GUI are signed automatically too, nothing extra to set up.
