| name | 1password |
| description | 1Password CLI (op) for reading/injecting secrets, managing vaults, and secure credential access. Use when asked to look up passwords, retrieve secrets, or manage 1Password items. |
| alwaysInclude | false |
| requiredBins | ["op"] |
| platforms | ["darwin","linux"] |
1Password CLI
Use the op CLI to securely read and inject secrets from 1Password.
Install
brew install 1password-cli
Setup
- Verify CLI:
op --version
- Enable desktop app integration (Settings > Developer > CLI integration)
- Sign in:
op signin
- Verify:
op whoami
Security Rules
- Never paste secrets into logs, chat, or code
- Prefer
op run / op inject over writing secrets to disk
- All
op commands should run inside a tmux session to maintain auth state
Common Commands
Read Secrets
op item get "Service Name" --fields password
op item get "Service Name" --fields username,password
op item get "Service Name" --vault "Work" --fields password
op read "op://VaultName/ItemName/FieldName"
List Items
op vault list
op item list --vault "Personal"
op item list --vault "Personal" | grep -i "service"
Inject Secrets
op run --env-file=.env.tpl -- ./my-script.sh
op inject -i config.tpl -o config.yml
Run with Environment Variables
op run --env-file=.env.tpl -- java -jar app.jar
tmux Session Pattern
Since op requires a persistent auth session:
tmux new-session -d -s op-session
tmux send-keys -t op-session "op signin" Enter
tmux send-keys -t op-session "op vault list" Enter
tmux capture-pane -t op-session -p
Notes
- If sign-in fails, re-run
op signin and authorize in the 1Password app
- Use
op account add for multiple accounts
- Use
--account flag or OP_ACCOUNT env var to specify account
- Desktop app must be unlocked for CLI integration to work