This skill guides integrating 1Password CLI (op) for secret management in development workflows. Use when loading secrets for infrastructure, deployments, or local development.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
This skill guides integrating 1Password CLI (op) for secret management in development workflows. Use when loading secrets for infrastructure, deployments, or local development.
op run --env-file=.op.env -- terraform plan
op run --env-file=.op.env -- rails server
Integration Patterns
Makefile Integration
OP ?= op
OP_ENV_FILE ?= .op.env
# Prefix for all commands needing secrets
CMD = $(OP) run --env-file=$(OP_ENV_FILE) --
deploy:$(CMD) kamal deploy
console:$(CMD) rails console
migrate:$(CMD) rails db:migrate
op read"op://Vault/Item/field"
op read"op://Vault/Item/field" --format json
op read"op://Vault/TLS/private_key" > /tmp/key.pem && chmod 600 /tmp/key.pem
Injecting into Commands
DATABASE_URL=$(op read"op://Production/DB/url") rails db:migrate
op run --env-file=.op.env -- ./deploy.sh
op run --account my-team --env-file=.op.env -- terraform apply
Managing Items
op vault list
op item list --vault Infrastructure
op item get "AWS" --vault Infrastructure
op item create --category login --vault Infrastructure \
--title "New Service" --field username=admin --field password=secret123
Project Setup
Initial Configuration
op signin
op vault list
cat > .op.env << 'EOF'
AWS_ACCESS_KEY_ID=op://Infrastructure/AWS/access_key_id
AWS_SECRET_ACCESS_KEY=op://Infrastructure/AWS/secret_access_key
DATABASE_URL=op://Production/Database/url
REDIS_URL=op://Production/Redis/url
EOF
op run --env-file=.op.env -- env | grep -E '^(AWS|DATABASE|REDIS)'
Placeholder Workflow
Create items with placeholder values upfront, populate with real credentials later:
op item create --vault myproject --category login \
--title "production-rails" --field master_key="PLACEHOLDER_UPDATE_BEFORE_DEPLOY"cat > .kamal/secrets << 'EOF'
RAILS_MASTER_KEY=$(op read"op://myproject/production-rails/master_key")
EOF
# Later: update with real value
op item edit "production-rails" --vault myproject \
master_key="actual_secret_value_here"
Vault Organization
Single-Vault Approach (Simpler)
Use one vault with naming conventions for environment separation:
Multi-Vault Approach (Team Scale) -- use when teams need different access controls:
Vault
Purpose
Access
Infrastructure
Cloud provider credentials
DevOps team
Production
Production app secrets
Deploy systems
Staging
Staging environment
Dev team
Development
Local dev secrets
Individual devs
Security Rules
Add .op.env and *.op.env to .gitignore -- never commit
Use service accounts for CI/CD, not personal accounts
Never pipe op read to logs or echo
Never store session tokens in scripts
Use variables for vault/item names in automation
Troubleshooting
op signin # Re-authenticate expired session
op whoami# Check current session
op vault list # Verify vault access
op item list --vault Infrastructure | grep -i aws # Search for items
op item get "AWS" --vault Infrastructure --format json | jq '.fields[].label'# Check field names
Multiple Accounts
Always specify account in automation -- never rely on "last signed in":
op vault list --account acme.1password.com
export OP_ACCOUNT=acme.1password.com
op run --account acme.1password.com --env-file=.op.env -- ./deploy.sh
Multi-Environment Pattern
Use per-environment env files: .op.env.production, .op.env.staging, .op.env.development
ENV ?= development
OP_ENV_FILE = .op.env.$(ENV)deploy:
op run --env-file=$(OP_ENV_FILE) -- kamal deploy
# Usage: make deploy ENV=production
