[flir]

It might be possible to lash up a cross-plaform solution with KeePassXC. It's got an API that can be accessed from the command line (chezmoi uses it to add secrets to dotfiles). Yes, you'd be authenticating every time you need a token but that might not be too much of a burden if you spend most of your time on a machine with a fingerprint scanner.

otoh I wouldn't do it, because I don't believe I could implement it securely.

[data-ottawa]

I’ve got this work 1password setup, the only issue is if you have background tasks.

I had a Borg backup script for example and 1password needed me to authenticate to run it.

Authenticating for ssh and git is great.