> ## Documentation Index > Fetch the complete documentation index at: https://www.1password.dev/llms.txt > Use this file to discover all available pages before exploring further. # Upgrade to 1Password CLI 2 export const Small = ({children}) => { return {children}; }; *Learn how to [upgrade to 1Password CLI 2](#step-1-choose-an-upgrade-strategy) from an earlier version, and [update your scripts](#step-2-update-your-scripts) to the new command syntax.* **1Password CLI 1 is deprecated** 1Password CLI 1 is deprecated as of **October 1, 2024**. Upgrade to 1Password CLI 2 to avoid disruptions with scripts or integrations that use version 1. ### About 1Password CLI 2 We released version 2 of the 1Password CLI in March 2022. Since then, more than 96% of users have adopted the latest version. 1Password CLI 2 includes a number of changes to the schema to make the tool easier to use as well as new features to help you provision secrets. #### New schema 1Password CLI 2 introduces a noun-verb command structure that groups commands by topic rather than by operation. You can find all available topics with `op --help`, and see the commands avaialble for each topic with `op --help`. Topics include: * [vault](/cli/reference/management-commands/vault/) * [item](/cli/reference/management-commands/item/) * [document](/cli/reference/management-commands/document/) * [user](/cli/reference/management-commands/user/) * [group](/cli/reference/management-commands/group/) * [account](/cli/reference/management-commands/account/) * [connect](/cli/reference/management-commands/connect/) * [events-api](/cli/reference/management-commands/events-api/) Other schema changes include: * The default output is now a human-friendly, tabular schema.
Learn how to change the default output to JSON. * The JSON output schema now contains more useful information. * Improved stdin processing allows you to chain more commands together. * The new schema uses flags instead of positional arguments. #### Secrets provisioning To help you provision secrets locally, 1Password CLI 2 allows you to load secrets directly from 1Password in environment variables and configuration files. With secrets provisioning, you can replace your plaintext secrets with references to the secrets stored in 1Password and load them at runtime in your scripts, applications, and other workflows. #### Integrate 1Password CLI with the 1Password desktop app You can sign in to 1Password CLI 2 with the accounts you've added to the 1Password desktop app, then authenticate your accounts on the command line with biometrics. #### Shell plugins To simplify and secure your workflow, 1Password CLI 2 introduces shell plugins that allow you to securely authenticate third-party command-line tools using biometrics. #### Package manager installation 1Password CLI 2 supports easier installation with package managers including Apt, Yum, Alpine, and tar. You can [find all changes in the changelog](https://releases.1password.com/developers/cli/). To share feedback with us, [visit the support community forum](https://1password.community/categories/cli-beta). ## Step 1: Choose an upgrade strategy There are multiple ways to upgrade to 1Password CLI 2. You can upgrade immediately or gradually, depending on your workflow and toolchain. ### Upgrade immediately The quickest way to upgrade to 1Password CLI 2 is to overwrite your existing installation. This is a good option if you have a small team who can upgrade their local installations simultaneously. 1. Use `which op` (or `(Get-Command op).Path` on Windows) to get the directory of the current installation. 2. [Download 1Password CLI 2](https://app-updates.agilebits.com/product_history/CLI2) and move `op` to the same directory, overwriting the existing copy. 3. To verify the installation, check the version number: ```shell theme={null} op --version ``` 4. [Update your scripts to use the 1Password CLI 2 syntax.](#step-2-update-your-scripts) Make sure everyone on your team upgrades to 1Password CLI 2. After you update your scripts, they won't work with earlier versions of 1Password CLI. ### Upgrade gradually If you're not ready to upgrade immediately, you can use Docker to upgrade individual projects or use both versions of 1Password CLI side-by-side. We will continue to support version 1 for one year after version 2 is released. #### Use Docker to upgrade individual projects If you want to upgrade project by project, you can Dockerize your workflow so that each team member uses the version of 1Password CLI in a Docker image for a specific project. This is a good option for large teams, because it doesn't require each team member to update a local installation. 1. [Use the 1Password CLI Docker image](https://hub.docker.com/r/1password/op) or use your own image and [add the CLI](/cli/get-started/). Your Dockerfile should look like this: ``` FROM 1password/op:2 COPY ./your-script.sh /your-script.sh CMD ["/your-script.sh"] ``` 2. After upgrading to 1Password CLI 2, [update your scripts](#step-2-update-your-scripts) to use the new command syntax.

This approach also sets you up to move your scripts to headless environments such as CI/CD pipelines.

#### Use both versions of 1Password CLI If your scripts depend on the local installation on each team member's machine, and you still want to migrate gradually, this is your best option. Each team member should do the following: 1. Rename the earlier version of 1Password CLI `op1`. 2. Find and replace all occurences of `op` with `op1`. 3. Install [1Password CLI 2](https://app-updates.agilebits.com/product_history/CLI2) inside your `$PATH`. For macOS 1Password CLI 2 has to be moved *exactly* to `/usr/local/bin/op`.
For Linux, it is recommended to be moved to `/usr/local/bin/op`. 4. [Update your scripts](#step-2-update-your-scripts) one-by-one to use the new `op`. You can continue to use your current scripts with the earlier version of 1Password CLI installed as `op1`. 5. When you've updated all your scripts and are ready to upgrade, uninstall the earlier version of 1Password CLI. 6. Find and replace all occurrences of `op1` in your scripts to `op`. ## Step 2: Update your scripts If you've been using an earlier version of 1Password CLI in scripts, you'll need to update your scripts to the new syntax. After you install 1Password CLI 2, use the following table to update your scripts. It shows all the updated commands and associated changes to arguments or flags. | Old command | CLI 2 command | Notes | | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [create vault](/cli/v1/reference/#create-vault) | [vault create](/cli/reference/management-commands/vault/#vault-create) | | | [get vault](/cli/v1/reference/#get-vault) | [vault get](/cli/reference/management-commands/vault/#vault-get) | | | [edit vault](/cli/v1/reference/#edit-vault) | [vault edit](/cli/reference/management-commands/vault/#vault-edit) | `--travel-mode=on/off` flag introduced | | [delete vault](/cli/v1/reference/#delete-vault) | [vault delete](/cli/reference/management-commands/vault/#vault-delete) | allows piped input when the `-` argument is provided | | [list vaults](/cli/v1/reference/#list-vaults) | [vault list](/cli/reference/management-commands/vault/#vault-list) | | | [list users --vault](/cli/v1/reference/#list-users) | [vault user list](/cli/reference/management-commands/vault/#vault-user-list) | | | [add group](/cli/v1/reference/#add-group) | [vault group grant](/cli/reference/management-commands/vault/#vault-group-grant) | | | [remove group](/cli/v1/reference/#remove-group) | [vault group revoke](/cli/reference/management-commands/vault/#vault-group-revoke) | | | [add user](/cli/v1/reference/#add-user) \ \ | [vault user grant](/cli/reference/management-commands/vault/#vault-user-grant) |
  • `--permission` flag must be used to specify the permissions to grant
  • granting allow\_viewing, allow\_editing and allow\_managing is equivalent to granting all permissions
  • `user` and `vault` arguments changed to `--user` and `--vault` flags
| | [remove user](/cli/v1/reference/#remove-user) \ \ | [vault user revoke](/cli/reference/management-commands/vault/#vault-user-revoke) |
  • `--permission` flag must be used to specify the permissions to revoke
  • revoking allow\_viewing, allow\_editing and allow\_managing is equivalent to revoking all permissions
  • `user` and `vault` arguments changed to `--user` and `--vault` flags
| | [signin](/cli/v1/reference/#signin) \ | [account add](/cli/reference/management-commands/account/#account-add) |
  • for new accounts/urls
  • the password can be piped in if email, address, and secret key are provided via flag
| | [signin](/cli/v1/reference/#signin) --list | [account list](/cli/reference/management-commands/account/#account-list) | account list will format its output based on output format selection (JSON vs human readable) | | [forget account](/cli/v1/reference/#forget) | [account forget](/cli/reference/management-commands/account/#account-forget) | new `-—all` flag for forgetting all accounts | | [get account](/cli/v1/reference/#get-account) | [account get](/cli/reference/management-commands/account/#account-get) | | | [confirm user](/cli/v1/reference/#confirm) | [user confirm](/cli/reference/management-commands/user/#user-confirm) | allows piped input when the `-` argument is provided | | [create user](/cli/v1/reference/#create-user) | [user provision](/cli/reference/management-commands/user/#user-provision) | `email` and `name` arguments changed to `--email` and `--name` flags | | [delete user](/cli/v1/reference/#delete-user) | [user delete](/cli/reference/management-commands/user/#user-delete) | allows piped input when the `-` argument is provided | | [edit user](/cli/v1/reference/#edit-user) | [user edit](/cli/reference/management-commands/user#user-edit) | allows piped input when the `-` argument is provided | | [reactivate user](/cli/v1/reference/#reactivate) | [user reactivate](/cli/reference/management-commands/user/#user-reactivate) | allows piped input when the `-` argument is provided | | [suspend user](/cli/v1/reference/#suspend) | [user suspend](/cli/reference/management-commands/user/#user-suspend) | `--deauthorize-devices-after` flag accepts any duration unit, not just seconds | | [list users](/cli/v1/reference/#list-users) | [user list](/cli/reference/management-commands/user#user-list) | | | [get user](/cli/v1/reference/#get-user) | [user get](/cli/reference/management-commands/user/#user-get) |
  • added `-—me` flag to get the currently authenticated user
  • `—publickey` changed to `—public-key`
| | [create connect server](/cli/v1/reference/#create-connect-server) | [connect server create](/cli/reference/management-commands/connect/#connect-server-create) | add `—-server` flag instead of using an argument for specifying the related server | | [delete connect server](/cli/v1/reference/#delete-connect-server) | [connect server delete](/cli/reference/management-commands/connect/#connect-server-delete) | allows piped input when the `-` argument is provided | | [edit connect server](/cli/v1/reference/#edit-connect-server) | [connect server edit](/cli/reference/management-commands/connect/#connect-server-edit) | | | [list connect servers](/cli/v1/reference/#list-connect-servers) | [connect server list](/cli/reference/management-commands/connect/#connect-server-list) | | | - | [connect server get](/cli/reference/management-commands/connect/#connect-server-get) | | | [create connect token](/cli/v1/reference/#create-connect-token) | [connect token create](/cli/reference/management-commands/connect/#connect-token-create) | | | [delete connect token](/cli/v1/reference/#delete-connect-token) | [connect token delete](/cli/reference/management-commands/connect/#connect-token-delete) | | | [edit connect token](/cli/v1/reference/#edit-connect-token) | [connect token edit](/cli/reference/management-commands/connect/#connect-token-edit) | argument name changed from `jti` to `token` | | [list connect tokens](/cli/v1/reference/#list-connect-tokens) | [connect token list](/cli/reference/management-commands/connect/#connect-token-list) | ConnectVault.ACL is now displayed in lowercase\_with\_underscores | | [add connect server](/cli/v1/reference/#add-connect-server) | [connect vault grant](/cli/reference/management-commands/connect/#connect-vault-grant) | `server` and `vault` arguments changed to `--server` and `--vault` flags | | [remove connect server](/cli/v1/reference/#remove-connect-server) | [connect vault revoke](/cli/reference/management-commands/connect/#connect-vault-revoke) | `server` and `vault` arguments changed to `--server` and `--vault` flags | | [manage connect add group](/cli/v1/reference/#manage-connect-add) | [connect group grant](/cli/reference/management-commands/connect/#connect-group-grant) | `server` and `group` arguments changed to `--server` and `--group` flags | | [manage connect remove group](/cli/v1/reference/#manage-connect-remove) | [connect group revoke](/cli/reference/management-commands/connect/#connect-group-revoke) | `server` and `group` arguments changed to `--server` and `--group` flags | | [create item](/cli/v1/reference/#create-item) | [item create](/cli/reference/management-commands/item/#item-create) |
  • `--template` flag to specify item template file replaces encode item as an argument
  • `category` argument changed to `--category` flag
  • Template JSON format has changed. [Learn more about the new format.](#appendix-json)
| | [delete item](/cli/v1/reference/#delete-item) | [item delete](/cli/reference/management-commands/item/#item-delete) | allows piped input when the `-` argument is provided | | [edit item](/cli/v1/reference/#edit-item) | [item edit](/cli/reference/management-commands/item/#item-edit) | new `--tags`, `--title`, `--url` flags | | [get item](/cli/v1/reference/#get-item) | [item get](/cli/reference/management-commands/item/#item-get) | | | [list items](/cli/v1/reference/#list-items) | [item list](/cli/reference/management-commands/item/#item-list) | | | [list templates](/cli/v1/reference/#list-templates) | [item template list](/cli/reference/management-commands/item/#item-template-list) | | | [get template](/cli/v1/reference/#get-template) | [item template get](/cli/reference/management-commands/item/#item-template-get) | | | [create group](/cli/v1/reference/#create-group) | [group create](/cli/reference/management-commands/group/#group-create) | | | [delete group](/cli/v1/reference/#delete-group) | [group delete](/cli/reference/management-commands/group/#group-delete) | allows piped input when the `-` argument is provided | | [edit group](/cli/v1/reference/#edit-group) | [group edit](/cli/reference/management-commands/group/#group-edit) | allows piped input when the `-` argument is provided | | [list groups](/cli/v1/reference/#list-groups) | [group list](/cli/reference/management-commands/group/#group-list) | | | [get group](/cli/v1/reference/#get-group) | [group get](/cli/reference/management-commands/group/#group-get) | | | [add user](/cli/v1/reference/#add-user) \ \ | [group user grant](/cli/reference/management-commands/group/#group-user-grant) | `user` and `group` arguments changed to `--user` and `--group` flags | | [remove user](/cli/v1/reference/#remove-user) \ \ | [group user revoke](/cli/reference/management-commands/group/#group-user-revoke) | `user` and `group` args changed to `--user` and `--group` flags | | [op list users --group \](/cli/v1/reference/#list-users) | [group user list](/cli/reference/management-commands/group/#group-user-list) | op list users `--group GROUP` still works | | [delete trash](/cli/v1/reference/#delete-trash) | - | deprecated | | [create document](/cli/v1/reference/#create-document) | [document create](/cli/reference/management-commands/document/#document-create) | `--filename` flag changed to `--file-name` flag | | [edit document](/cli/v1/reference/#edit-document) | [document edit](/cli/reference/management-commands/document/#document-edit) | `--filename` flag changed to `--file-name` flag | | [list documents](/cli/v1/reference/#list-documents) | [document list](/cli/reference/management-commands/document/#document-list) | | | [get document](/cli/v1/reference/#get-document) | [document get](/cli/reference/management-commands/document/#document-get) | | | [delete document](/cli/v1/reference/#delete-document) | [document delete](/cli/reference/management-commands/document/#document-delete) | | | [create integration events-api](/cli/v1/reference/#create-integration-events-api) | [events-api create](/cli/reference/management-commands/events-api/#events-api-create) | | | [list events](/cli/v1/reference/#list-events) | - | Use [1Password Events API](/events-api/) instead. | | [encode](/cli/v1/reference/#encode) | - | deprecated, use `create item --template=file.json` instead | | [get totp](/cli/v1/reference/#get-totp) | [item get --otp](/cli/reference/management-commands/item/#item-get) | | ## Appendix: Change default output to JSON The default output format for 1Password CLI 2 is a human-readable, tabular schema. You can change the default to machine-readable JSON in two ways: * For a single command, include the `--format json` flag with your command. For example, `op item get --format json`. * To always default to JSON, set the `$OP_FORMAT` environment variable to `json`.

Appendix: Item JSON template

You can expect to see several formatting improvements and field name changes in 1Password CLI 2 [item JSON templates](/cli/item-template-json/).
**Old template** ```json theme={null} { "fields": [ { "designation": "username", "name": "username", "type": "T", "value": "" }, { "designation": "password", "name": "password", "type": "P", "value": "" } ], "notesPlain": "", "passwordHistory": [], "sections": [] } ```
**New template** ```json theme={null} { "title": "", "category": "LOGIN", "fields": [ { "id": "username", "type": "STRING", "purpose": "USERNAME", "label": "username", "value": "" }, { "id": "password", "type": "CONCEALED", "purpose": "PASSWORD", "label": "password", "value": "" }, { "id": "notesPlain", "type": "STRING", "purpose": "NOTES", "label": "notesPlain", "value": "" } ] } ```
This is how 1Password CLI 1 template fields correspond to 1Password CLI 2: **Item** | 1Password CLI 1 | 1Password CLI 2 | Notes | | --------------- | --------------- | ----------------------------------- | | `uuid` | | | | `templateUuid` | `category` | | | `details` | - | replaced by `sections` and `fields` | **Section** | 1Password CLI 1 | 1Password CLI 2 | Notes | | --------------- | --------------- | ---------------- | | `name` | `id` | | | `title` | `label` | | | `fields` | - | moved separately | **Field** | 1Password CLI 1 | 1Password CLI 2 | | --------------- | --------------- | | `n` | `id` | | `k` | `type` | | `t` | `label` | | `v` | `value` | | - | `section` | ## Get help If you need help upgrading to 1Password CLI 2, [contact 1Password Support](mailto:integrations@1password.com) or join our [Developer Slack workspace](/joinslack) and ask a question in the `#cli` channel. ## Learn more * [Get started with 1Password CLI 2](/cli/get-started/) * [1Password CLI 2 release notes](https://releases.1password.com/developers/cli/)