One Password

1Password CLI

Retrieve secrets and manage credentials from 1Password without hardcoding them in scripts or environment files.

Setup

bashCopy code
# Install 1Password CLI (op)
# macOS
brew install 1password-cli

# Linux
curl -sS https://downloads.1password.com/linux/keys/1password.asc | gpg --import
# See: developer.1password.com/docs/cli/get-started

# Windows
winget install AgileBits.1Password.CLI

# Verify
op --version

Authentication

bashCopy code
# Sign in (opens browser or prompts)
op signin

# Or with service account (CI/CD)
export OP_SERVICE_ACCOUNT_TOKEN="eyJhbGci..."

# Check auth
op whoami

Read Secrets

bashCopy code
# Read a field from an item
op item get "AWS Credentials" --field "access key id"
op item get "GitHub Token" --field password

# Read by item ID
op item get "abc123xyz" --field password

# Read as env var format
op item get "AWS Credentials" --format json

Inject into Environment

bashCopy code
# op run: inject secrets into any command
op run --env-file=".env.1password" -- python my_script.py

# .env.1password format:
# AWS_ACCESS_KEY_ID=op://Private/AWS Credentials/access key id
# AWS_SECRET_ACCESS_KEY=op://Private/AWS Credentials/secret access key
# DATABASE_URL=op://Work/Production DB/connection string

Secret Reference Syntax

Copy code
op://VAULT/ITEM/FIELD
op://Private/GitHub/token
op://Work/AWS Production/access key id

Use in .env.1password or in shell scripts:

bashCopy code
export GITHUB_TOKEN=$(op item get "GitHub" --field token)
export DB_PASS=$(op item get "PostgreSQL Prod" --field password)

In Python Scripts

pythonCopy code
import subprocess

def get_secret(vault, item, field):
    result = subprocess.run(
        ["op", "item", "get", item, "--vault", vault, "--field", field],
        capture_output=True, text=True, check=True
    )
    return result.stdout.strip()

db_password = get_secret("Work", "PostgreSQL Prod", "password")
api_key = get_secret("Private", "OpenAI", "api key")

List and Search

bashCopy code
# List all vaults
op vault list

# List items in vault
op item list --vault Private

# Search
op item list --categories Login --tags production

Create Items

bashCopy code
# Create a login
op item create \
  --category Login \
  --title "My Service" \
  --vault Work \
  username="admin" \
  password="$(openssl rand -base64 32)"

# Create an API credential
op item create \
  --category "API Credential" \
  --title "OpenAI" \
  credential="sk-..."

CI/CD Integration

yamlCopy code
# GitHub Actions
- name: Configure 1Password
  uses: 1password/load-secrets-action@v2
  with:
    export-env: true
  env:
    OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
    AWS_ACCESS_KEY_ID: op://CI/AWS/access-key-id
    AWS_SECRET_ACCESS_KEY: op://CI/AWS/secret-access-key

SSH Key Management

bashCopy code
# 1Password SSH Agent (stores SSH keys in 1Password)
# Enable in 1Password Settings → Developer → SSH Agent

# Use in ~/.ssh/config:
Host github.com
  IdentityAgent "~/Library/Group Containers/.../agent.sock"

# List SSH keys
op item list --categories "SSH Key"

Why Use 1Password CLI

• No secrets in .env files committed to git
• Rotate credentials without touching code
• Audit log of who accessed what
• Works offline (cached vault)
• Team sharing without exposing plaintext