Password Manager (1Password)
Read secrets and inject environment variables from 1Password using the op CLI.
Prerequisites
brew install 1password-cli
Sign in:
op signin
Or for biometric unlock (recommended):
- Open 1Password app → Settings → Developer → enable "Integrate with 1Password CLI"
- Then
opcommands will use Touch ID automatically
Verify:
op whoami
Commands
| Command | Description |
|---|---|
op whoami |
Show current signed-in account |
op vault list |
List all vaults |
op item list |
List all items |
op item list --vault "<Vault>" |
List items in a vault |
op item get "<Item Name>" |
Get full item details |
op item get "<Item Name>" --fields password |
Get just the password field |
op read "op://<vault>/<item>/<field>" |
Read a specific field by URI |
op run --env-file=.env.1p -- <command> |
Inject secrets as env vars and run command |
op inject -i .env.tpl -o .env |
Render a secrets template to a file |
Usage Examples
Get an API key:
op read "op://Personal/OpenAI/api_key"
Get a database password:
op item get "Production DB" --fields password
Inject secrets and run a script:
# .env.1p file contains: API_KEY=op://Work/MyService/api_key
op run --env-file=.env.1p -- python3 script.py
List all items in Work vault:
op item list --vault "Work" --format json | jq '.[].title'
Rules
- Always check if CLI is installed and signed in:
op whoami - If not installed, show
brew install 1password-cliand stop - If not signed in, show
op signinand stop - NEVER print secret values in assistant responses — only confirm "retrieved" or use them directly in commands
- NEVER write secrets to files that might be committed (e.g.,
.envin a git repo) without warning the user - NEVER log, store, or repeat credential values in memory or workspace files
- Use
op readURI format for precise field access; useop item getwhen unsure of field names - For injecting into commands, prefer
op runover reading the secret and passing it as an argument - If the user asks "what's my password for X", retrieve it and only show the value in the terminal — do not include it in any saved file