Env From 1password

Load Environment Variables from 1Password

Fetches environment variables from a 1Password item and writes them to .env.local in the current project.

Prerequisites

1. 1Password desktop app installed (download from 1password.com)

2. 1Password CLI installed:

   brew install --cask 1password-cli
   

3. Enable desktop app integration:

   • Open 1Password app → Settings → Developer
   • Enable "Connect with 1Password CLI"
   • Restart the 1Password app after enabling (important!)
   • This allows the CLI to use your existing 1Password session

4. Verify CLI access:

   op whoami
   

   Should show your account details if integration is working.

   Troubleshooting: If you see "couldn't connect to desktop app":

   • Make sure 1Password app is running
   • Restart the 1Password app
   • Update to latest version if needed

5. Environment variables stored in 1Password as a Secure Note with the env vars in the notes field

How It Works

1. Check for multiple accounts (if user has more than one):

   op account list
   

   If multiple accounts exist, you'll need to specify --account flag in subsequent commands.

2. List available 1Password items to help user identify the right one:

   # Single account:
   op item list | grep -i "env"
   
   # Multiple accounts (specify which one):
   op item list --account=my.1password.com | grep -i "env"
   

3. Ask the user which item contains their environment variables (by name or ID)

4. Fetch the item and extract fields:

   op item get "$ITEM_NAME" --format=json
   

5. Parse fields and write to .env.local:

   • For Secure Notes: Extract from fields array where type is not CONCEALED (skip password fields)
   • For each field: label=value format
   • Common patterns:
     • Field with label and value properties
     • Sections with multiple fields
     • Handle notesPlain for multi-line env content

6. Write to .env.local:

   # From notes field (recommended - simpler format)
   op item get "$ITEM_NAME" --account=ACCOUNT_NAME --fields label=notesPlain | tr -d '"' > .env.local
   

   Or for structured fields:

   op item get "$ITEM_NAME" --account=ACCOUNT_NAME --format=json | jq -r '.fields[] | select(.value != null) | "\(.label)=\(.value)"' > .env.local
   

   Note: The tr -d '"' removes surrounding quotes that op adds to field values.

Example Workflow

# 1. Check if you have multiple accounts
op account list

# 2. List items to find the right one
op item list --account=my.1password.com | grep -i "env"

# 3. Get env vars from 1Password (from notes field - recommended)
op item get "Dev Environment" --account=my.1password.com --fields label=notesPlain | tr -d '"' > .env.local

# 4. Confirm
cat .env.local

1Password Item Format

Option 1: Secure Note with plain text

Store all env vars in the notes field:

DATABASE_URL=postgresql://postgres:postgres@localhost:5432/mydb
REDIS_URL=redis://localhost:6379
STRIPE_SECRET_KEY=sk_test_...
NEXT_PUBLIC_APP_URL=http://localhost:3000

Option 2: Structured fields

Create fields for each env var:

• Field: DATABASE_URL, Value: postgresql://...
• Field: REDIS_URL, Value: redis://...
• Field: STRIPE_SECRET_KEY, Type: password/concealed, Value: sk_test_...

What This Creates

• .env.local file with all environment variables from 1Password
• Preserves formatting and comments if using notes field
• Filters out non-value fields if using structured format

Available Keys

The following environment variables are available in 1Password:

Security Notes

• .env.local should be in .gitignore (Next.js does this by default)
• Never commit .env.local to version control
• Rotate secrets if accidentally committed
• Use separate 1Password items for different environments (dev/staging/prod)

Next Steps

After loading env vars:

1. Review the file:

   cat .env.local
   

2. Add any project-specific overrides manually

3. Run the app:

   bun dev
   

Tips

• Multiple environments: Create separate 1Password items for dev/staging/prod
• Team sharing: Share the 1Password vault with your team
• Updates: Re-run this skill to refresh .env.local when secrets change
• Validation: Use with /env-config skill for type-safe env validation