[aheritier]

Summary

The secrets guide described credential_helper as a general secret source that receives the variable name as its last argument. The code does neither:

• CredentialHelperProvider.Get returns nothing for any name other than DOCKER_TOKEN (pkg/environment/credential_helper.go).
• The command runs with its configured args only; no variable name is appended.

Following the old example (op read op://Personal/docker-agent) to load provider API keys silently does nothing.

Changes

• Credential Helper section: scope it to DOCKER_TOKEN, point other secrets to the remaining sources, fix the example and the invocation description.
• Overview: state that op:// resolution is independent of the helper and works for every variable, API keys included.
• Credential Helper: an IMPORTANT callout pointing API-key users to op:// references, since an op helper example reads as "this is how to load keys from 1Password".
• Source table and "Choosing a Method" table: same scope.
• 1Password References: tip on keeping op:// values out of the shell (Docker Agent env file or token_key), since tools such as Claude Code and Codex read the same variables and do not resolve op://.

References

Topic	Link
Credential helper provider	pkg/environment/credential_helper.go
User config type	pkg/userconfig/userconfig.go (CredentialHelper)
Default source chain	pkg/environment/default.go
1Password op read	1Password CLI: op read
token_key	Model configuration

[Copilot]

🟢 Approval recommended

The focused documentation changes match existing behavior, with no unresolved issues identified.

No open issues 🎉

What changed in this PR

This documentation-only update aligns the secrets guide with the credential helper’s existing behavior.

Changes:

• Clarifies that credential helpers supply only DOCKER_TOKEN and receive no appended arguments.
• Corrects the 1Password helper example and scopes both comparison tables accordingly.
• Adds guidance for keeping op:// references separate from variables used by other tools.

File	Description
docs/​guides/​secrets/​index.md	Corrects credential helper documentation and adds 1Password reference guidance.

_{Review effort: Balanced}