> ## Documentation Index
> Fetch the complete documentation index at: https://www.1password.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Use 1Password to securely authenticate OpenTofu CLI

> Store your credentials in 1Password then authenticate OpenTofu CLI with your fingerprint.

export const ContributorCredit = ({handle, prUrl}) => {
  return <p>
      <em>
        Thanks to <a href={`https://github.com/${handle}`}>@{handle}</a> for{" "}
        <a href={prUrl}>contributing this plugin</a>! Learn how to{" "}
        <a href="/cli/shell-plugins/contribute">build your own shell plugins</a>.
      </em>
    </p>;
};

export const ReferenceAnyCredential = ({name, command}) => {
  return <>
      <p>
        Unlike most shell plugins, {name} doesn't define its own set of credentials. Instead, it can
        provision any of the credentials you've already configured in 1Password for your other shell
        plugins, so you can use them within your {name} project.
      </p>

      <p>
        When you run <code>op plugin init {command}</code>, you choose which of your saved 1Password items
        to use, and 1Password provisions them automatically when you run {name} commands that need them.
      </p>
    </>;
};

export const GetHelp = ({name, command, imgInspect}) => {
  return <>
      <h3>Inspect your configuration</h3>

      <p>To inspect your current {name} configuration:</p>

      <CodeBlock language="shell" children={`op plugin inspect ${command}`} />

      <p>
        1Password CLI will return a list of the credentials you've configured to use with {name} and their default
        scopes, as well as a list of aliases configured for {name}.
      </p>

      {imgInspect ? <Frame>
          <img src={imgInspect} alt="A terminal window showing the results of the command op plugin inspect." width="900" />
        </Frame> : null}

      <h3>Clear your credentials</h3>

      <p>To reset the credentials used with {name}:</p>

      <CodeBlock language="shell" children={`op plugin clear ${command}`} />

      <p>You can clear one configuration at a time, in this order of precedence:</p>

      <ol>
        <li>Terminal session default</li>
        <li>
          Directory default, from the current directory to <code>$HOME</code>
        </li>
        <li>Global default</li>
      </ol>

      <p>
        For example, if you're in the directory <code>$HOME/projects/awesomeProject</code> and you have a terminal
        session default, directory defaults for <code>$HOME</code> and <code>$HOME/projects/awesomeProject</code>, and
        a global default credential configured, you would need to run <code>op plugin clear {command}</code> four times
        to clear all of your defaults.
      </p>

      <p>
        To clear your global default credentials, terminal session default, and the defaults for your current directory
        at the same time, run <code>op plugin clear {command} --all</code>.
      </p>
    </>;
};

export const Step4RemoveCredentials = ({name}) => {
  return <p>
      After saving your {name} credentials in 1Password, you can remove all local copies you previously had stored on
      disk.
    </p>;
};

export const Step3UseTheCliAnyCredential = ({executableName, imgAuth, imgAuthAlt}) => {
  return <>
      <p>
        The next time you use {executableName} with one of the providers you configured credentials for, you'll be
        prompted to authenticate with biometrics or system authentication.
      </p>

      {imgAuth ? <Frame>
          <img src={imgAuth} alt={imgAuthAlt || `The ${executableName} being authenticated using 1Password CLI biometric unlock.`} width="900" />
        </Frame> : null}
    </>;
};

export const Step1ConfigureAnyCredential = ({name, command, imgInit, imgChoose, imgImport, imgSearch, imgScope}) => {
  return <>
      <p>To get started with the {name} shell plugin:</p>

      <ol>
        <li>
          Sign in to the 1Password account you want to use with the {name} plugin:{" "}
          <CodeBlock language="shell" children={`op signin`} />
        </li>
        <li>If you only want to configure the plugin in a specific directory, change to that directory.</li>
        <li>
          Run the command to set up the plugin:
          <CodeBlock language="shell" children={`op plugin init ${command}`} />
        </li>
      </ol>

      <p>
        You'll be prompted to select the credential types you want to use with {name}. Select the credential type for{" "}
        <a href="/cli/shell-plugins#get-started">a supported provider</a>, then you can either{" "}
        <a href="#import-a-new-item">import the credential</a> into your 1Password account or{" "}
        <a href="#select-an-existing-item">select an existing 1Password item</a> where the credential is saved.
      </p>

      <p>
        When you've configured all the credentials you want to use with {name}, select{" "}
        <strong>Stop choosing credentials</strong>.
      </p>

      {imgInit ? <Frame>
          <img src={imgInit} alt="A terminal window displaying the op plugin init command." width="900" />
        </Frame> : null}

      {imgChoose ? <Frame>
          <img src={imgChoose} alt={`A terminal window showing the prompt to choose credential types to use with ${command}.`} width="900" />
        </Frame> : null}

      <h3>Step 1.1: Import or select an item</h3>

      <h4 id="import-a-new-item">Import a new item</h4>

      <p>
        If you haven't saved a credential in 1Password yet, select <strong>Import into 1Password</strong>. Enter a
        name for the new 1Password item and select the vault where you want to save it.
      </p>

      <p>
        If 1Password detects the credential in your local development environment, you'll be prompted to import it
        automatically.
      </p>

      {imgImport ? <Frame>
          <img src={imgImport} alt="A terminal window showing the fields available to import an item, including the token, item name, and vault." width="900" />
        </Frame> : null}

      <h4 id="select-an-existing-item">Select an existing item</h4>

      <p>
        If you've already saved a credential in 1Password, select <strong>Search in 1Password</strong>.
      </p>

      <p>
        You'll see a list of related items and the vaults where they're saved. If you don't see the credential,
        select <strong>Expand search</strong> to browse all items in your account.
      </p>

      {imgSearch ? <Frame>
          <img src={imgSearch} alt="A terminal window showing the option to search for an existing item in your 1Password account." width="900" />
        </Frame> : null}

      <h3>Step 1.2: Set default credential scope</h3>

      <p>
        After you finish selecting your credentials, you'll be prompted to configure when to use them.
      </p>

      {imgScope ? <Frame>
          <img src={imgScope} alt="A terminal window showing the options for configuring when the credentials should be used." width="900" />
        </Frame> : null}

      <ul>
        <li>
          <strong>"Prompt me for each new terminal session"</strong> will only configure the credentials for the
          duration of the current terminal session. Once you exit the terminal, the defaults will be removed.
        </li>
        <li>
          <strong>"Use automatically when in this directory or subdirectories"</strong> will make the credentials the
          default in the current directory and all of its subdirectories, as long as no other directory-specific
          defaults are set in them. A terminal-session default takes precedence over a directory-specific one.
        </li>
        <li>
          <strong>"Use as global default on my system"</strong> will set the credentials as the defaults in all terminal
          sessions and directories. A directory-specific default takes precedence over a global one.
        </li>
      </ul>
    </>;
};

export const Requirements = ({executableName, installUrl, installIcon, minCliVersion}) => {
  return <>
      <ol>
        <li>
          <a href="https://1password.com/pricing/password-manager">Sign up for 1Password.</a>
        </li>
        <li>
          Install and sign in to 1Password for <a href="https://1password.com/downloads/mac">Mac</a> or{" "}
          <a href="https://1password.com/downloads/linux">Linux</a>.
        </li>
        <li>
          Install <a href="https://app-updates.agilebits.com/product_history/CLI2">1Password CLI</a> {minCliVersion} or
          later.
          <br />
          <small>
            If you've already installed 1Password CLI, learn how to{" "}
            <a href="/cli/reference/update/">update your installation</a>.
          </small>
        </li>
        <li>
          <a href="/cli/app-integration/">Connect 1Password CLI with the 1Password app</a>.
        </li>
        <li>
          <a href={installUrl}>
            Install {executableName}.{installIcon ? <> <Icon icon={installIcon} /></> : null}
          </a>
        </li>
      </ol>

      <p>The following shells are supported:</p>

      <ul>
        <li>Bash</li>
        <li>Zsh</li>
        <li>fish</li>
      </ul>
    </>;
};

export const IntroAnyCredential = ({name, executableName, installUrl, installIcon}) => {
  return <>
      <p>
        The {name} shell plugin allows you to use 1Password to securely authenticate{" "}
        <a href={installUrl}>
          {executableName}
          {installIcon ? <> <Icon icon={installIcon} /></> : null}
        </a>{" "}
        with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in
        plaintext.
      </p>

      <p>
        You can configure the {name} plugin to provision credentials from the{" "}
        <a href="/cli/shell-plugins#get-started">1Password Shell Plugin ecosystem</a> for use with providers such as
        AWS, MongoDB Atlas, or Databricks.
      </p>
    </>;
};

<IntroAnyCredential name="OpenTofu" executableName="OpenTofu CLI" installUrl="https://opentofu.org/docs/cli" installIcon="arrow-up-right-from-square" />

## Requirements

<Requirements executableName="OpenTofu CLI" installUrl="https://opentofu.org/docs/cli" installIcon="arrow-up-right-from-square" minCliVersion="2.35.0" />

## Step 1: Configure your default credentials

<Step1ConfigureAnyCredential name="OpenTofu" command="tofu" />

## Step 2: Source the plugins.sh file

To make the plugin available, source your `plugins.sh` file. For example:

```shell theme={null}
source ~/.config/op/plugins.sh
```

The file path for your `op` folder may vary depending on your [configuration directory](/cli/config-directories/). `op plugin init` will output a source command with the correct file path.

If this is your first time installing a shell plugin, you'll also need to add the source command to your RC file or shell profile to persist the plugin beyond the current terminal session. For example:

<CodeGroup>
  ```shell Bash theme={null}
  echo "source ~/.config/op/plugins.sh" >> ~/.bashrc && source ~/.bashrc
  ```

  ```shell Zsh theme={null}
  echo "source ~/.op/plugins.sh" >> ~/.zshrc && source ~/.zshrc
  ```

  ```shell Fish theme={null}
  echo "source ~/.op/plugins.sh" >> ~/.config/fish/config.fish && source ~/.config/fish/config.fish
  ```
</CodeGroup>

## Step 3: Use the CLI

<Step3UseTheCliAnyCredential executableName="OpenTofu CLI" />

## Step 4: Remove imported credentials from disk

<Step4RemoveCredentials name="OpenTofu" />

## Next steps

1Password Shell Plugins support [more than 60 third-party CLIs](/cli/shell-plugins/#get-started). To see a list of supported CLIs:

```shell theme={null}
op plugin list
```

To choose another plugin to get started with:

```shell theme={null}
op plugin init
```

To use shell plugins for seamless context switching, learn how to configure a plugin in [multiple environments](/cli/shell-plugins/environments/) or with [multiple accounts.](/cli/shell-plugins/multiple-accounts/)

## Get help

<GetHelp name="OpenTofu" command="tofu" />

## Reference

<ReferenceAnyCredential name="OpenTofu" command="tofu" />

<ContributorCredit handle="ianneub" prUrl="https://github.com/1Password/shell-plugins/pull/585" />


## Related topics

- [Use 1Password to securely authenticate the OpenAI CLI](/cli/shell-plugins/openai.md)
- [Use 1Password to securely authenticate OpenCode CLI](/cli/shell-plugins/opencode.md)
- [Use 1Password to securely authenticate OpenAI Evals](/cli/shell-plugins/openai-evals.md)