`--category` Sets the item category, in this case a Login item. Use op item template list to get a list of available categories. The category value is case-insensitive and ignores whitespace characters. For example, the Social Security Number category can also be specified as socialsecuritynumber.

`--title` Gives the item a name so that you can easily identify it. If unspecified, 1Password CLI selects a default name. For example, Untitled Login item.

`--vault` Specifies which vault the item should be created in. If unspecified, the item will be created in your built-in Personal, Private, or Employee vault. The name of this vault varies depending on your account type.

`--url` Sets the website where 1Password suggests and fills a Login, Password, or API Credential item.

`--generate-password` Generates a strong password for Login and Password category items. You can specify a password recipe, as shown in the example. If left unspecified, a default recipe will be used to generate a 32-character password consisting of letters, digits, and symbols.

.][[]]= ``` * `section` (Optional) The name of the section where you want to create the field. * `field` The name of the field you want to create. * `fieldType` The type of field you want to create. If unspecified, fieldType will default to password. * `value` The information you want to save in the field. For built-in fields, the `field` name should match the [built-in field `id`](/cli/item-fields/#built-in-fields) in the item category template. Don't include a `fieldType` for built-in fields. For custom fields, the `fieldType` should match the [custom field `type`](/cli/item-fields/#custom-fields) you want to create. The `field` name can be anything you want. If you need to use periods, equal signs, or backslashes in the name of a section or field, use a backslash character to escape them. Don't use backslashes to escape the `value`. Here's an example of an assignment statement for the built-in field `username` on a Login item, set to `john.doe@acme.org`: ```shell theme={null} 'username=john.doe@acme.org' ``` And here's an example of an assignment statement for a custom field type titled `date`, which is set to `2022-12-31`, in a field named `Renewal Date` within a section titled `Subscription Info`: ```shell theme={null} 'Subscription Info.Renewal Date[date]=2022-12-31' ``` To add both of the above assignment statements to a new item, `HBO Max`, in the `Tutorial` vault: ```shell theme={null} op item create \ --category login \ --title "HBO Max" \ --vault Tutorial \ --url 'https://www.hbomax.com' \ --generate-password='letters,digits,symbols,32' \ --tags tutorial,entertainment \ 'username=john.doe@acme.org' \ 'Subscription Info.Renewal Date[date]=2022-12-31' ``` ```powershell theme={null} op item create ` --category login ` --title "HBO Max" ` --vault Tutorial ` --url 'https://www.hbomax.com' ` --generate-password='letters,digits,symbols,32' ` --tags tutorial,entertainment ` 'username=john.doe@acme.org' ` 'Subscription Info.Renewal Date[date]=2022-12-31' ``` ### With an item JSON template To assign sensitive values, fill out an item JSON template for the category of item you want to create. If you combine field assignment statements with a template, the assignment statements overwrite the template's values. To see a list of available templates, run [`op item template list`](/cli/reference/management-commands/item#item-template-list). To get a template for a category, run [`op item template get `](/cli/reference/management-commands/item#item-template-get). For example, to create a new Login item using a template: 1. Get the template for a Login item and save it in your current directory: ```shell theme={null} op item template get --out-file=login.json "Login" ``` 2. Edit [the template file](/cli/item-template-json/) to add your information. 3. Create the item using the `--template` flag to specify the path to the template file: ```shell theme={null} op item create --template=login.json ``` This example template file creates a Login item named `Hulu` in a vault [specified by its ID](/cli/reference/#unique-identifiers-ids). It specifies values for built-in `username`, `password`, and `notesPlain` fields. It also adds a custom `date` field. ```json login.json theme={null} { "title": "Hulu", "vault": { "id": "sor33rgjjcg2xykftymcmqm5am" }, "category": "LOGIN", "fields": [ { "id": "username", "type": "STRING", "purpose": "USERNAME", "label": "username", "value": "wendy.appleseed@gmail.com" }, { "id": "password", "type": "CONCEALED", "purpose": "PASSWORD", "label": "password", "password_details": { "strength": "" }, "value": "Dp2WxXfwN7VFJojENfEHLEBJmAGAxup@" }, { "id": "notesPlain", "type": "STRING", "purpose": "NOTES", "label": "notesPlain", "value": "This is Wendy's Hulu account." }, { "id": "date", "type": "date", "label": "Subscription renewal date", "value": "2023-04-05" } ] } ``` 4. Delete the edited template file from your computer. You can also create an item from standard input using a template: ```shell theme={null} op item template get Login | op item create --vault Tutorial - ``` ## Create an item from an existing item You can create a new item from an existing item by piping the item JSON from standard input. For example, to create a new item based on the `HBO Max` item you created in the assignment statement section, with a new title, username, and password: ```shell theme={null} op item get "HBO Max" --format json | op item create --vault Tutorial --title "Wendy's HBO Max" - 'username=wendy.appleseed@acme.org' 'password=Dp2WxXfwN7VFJojENfEHLEBJmAGAxup@' ``` ## Add a one-time password to an item You can attach a [one-time password](https://support.1password.com/one-time-passwords/) to an item using a custom field [assignment statement](#with-assignment-statements). The `fieldType` should be `otp` and the `value` should be the [otpauth:// URI](https://github.com/google/google-authenticator/wiki/Key-Uri-Format) for the one-time password. ```shell theme={null} op item create \ --category login \ --title='My OTP Example' \ --vault Tutorial \ --url 'https://www.acme.com/login' \ --generate-password='letters,digits,symbols,32' \ --tags tutorial,entertainment \ 'Test Section 1.Test Field3[otp]=otpauth://totp/:?secret=&issuer=' ``` ```powershell theme={null} op item create ` --category login ` --title='My OTP Example' ` --vault Tutorial ` --url 'https://www.acme.com/login' ` --generate-password='letters,digits,symbols,32' ` --tags tutorial,entertainment ` 'Test Section 1.Test Field3[otp]=otpauth://totp/:?secret=&issuer=' ``` ## Attach a file to an item You can attach a file to an item using a custom field [assignment statement](#with-assignment-statements). The `field` should be the name the file will have in 1Password, the `fieldType` should be `file`, and the `value` should be the path to the file. Include the file extension in the field name by [escaping the period with a backslash](#with-assignment-statements). This keeps the extension visible in 1Password instead of stripping it from the name. ```shell theme={null} JanuaryReceipt\.png[file]=/path/to/your/receipt.png ``` The file in the above example will be named `JanuaryReceipt.png`. To preserve the original file name from the path, you can omit the `field`: ```shell theme={null} [file]=/path/to/your/file ``` Here's what an example `PlayStation Store` login would look like with the file `/wendyappleseed/documents/receipt.png` attached, named `JanuaryReceipt.png`. ```shell theme={null} op item create \ --category login \ --title "PlayStation Store" \ --vault Tutorial \ --url 'https://store.playstation.com/' \ --generate-password='letters,digits,symbols,32' \ --tags tutorial,entertainment \ 'JanuaryReceipt\.png[file]=/wendyappleseed/documents/receipt.png' ``` ```powershell theme={null} op item create ` --category login ` --title "PlayStation Store" ` --vault Tutorial ` --url 'https://store.playstation.com/' ` --generate-password='letters,digits,symbols,32' ` --tags tutorial,entertainment ` 'JanuaryReceipt\.png[file]=/wendyappleseed/documents/receipt.png' ``` ## Next steps If you want to continue learning about item management, keep the example items you created and move on to the [edit items](/cli/item-edit) tutorial. If you created a Tutorial vault and don't want to continue on, you can delete the vault and the examples items you created by running: ```shell theme={null} op vault delete "Tutorial" ``` ## Learn more * [`op item create` reference documentation](/cli/reference/management-commands/item#item-create) * [Built-in and custom item fields](/cli/item-fields) * [Item JSON template](/cli/item-template-json) * [Workflow: Build integrations with 1Password](/get-started/build-integrations) # Edit items Source: https://www.1password.dev/cli/item-edit To edit an existing item in your 1Password account, use the [`op item edit`](/cli/reference/management-commands/item#item-edit) command. You can [edit basic information about the item](#edit-an-item’s-basic-information) with flags and use assignment statements to [edit an item's built-in and custom fields](#edit-built-in-and-custom-fields). To edit sensitive values, [use a JSON template](#edit-an-item-using-a-json-template). You can't use op item edit to edit SSH keys. Learn more about managing SSH keys with 1Password CLI. ## Requirements Before you can use 1Password CLI to edit items, you'll need to: * [Sign up for 1Password](https://1password.com/pricing/password-manager) * [Install 1Password CLI](/cli/get-started#step-1-install-1password-cli) **Follow along** If you want to follow along with the examples in this guide, [create the example items in the guide to creating items](/cli/item-create) first. ## Edit an item's basic information To edit an item, use [`op item edit`](/cli/reference/management-commands/item#item-edit) and specify the item by name, [unique identifier (ID)](/cli/reference#unique-identifiers-ids), or sharing link. You can use flags to generate a new password and edit an item's title, vault, or tags. You can also change the website where 1Password suggests and fills a Login, Password, or API Credential item. For example, to change the name of the example item `Netflix`, move it from the `Tutorial` vault to the `Private` vault, update its tags, edit its website, and generate a new random password: ```shell theme={null} op item edit "Netflix" \ --title "Edited Netflix" \ --vault Private \ --tags tutorial \ --url https://www.netflix.com \ --generate-password='letters,digits,symbols,32' ``` ```powershell theme={null} op item edit "Netflix" ` --title "Edited Netflix" ` --vault Private ` --tags tutorial ` --url https://www.netflix.com ` --generate-password='letters,digits,symbols,32' ``` To change the example item name back to `Netflix` and move it back to the `Tutorial` vault: ```shell theme={null} op item edit "Edited Netflix" \ --title "Netflix" \ --vault Tutorial ``` ```powershell theme={null} op item edit "Edited Netflix" ` --title "Netflix" ` --vault Tutorial ``` ## Edit built-in and custom fields Command arguments can be visible to other processes on your machine. To edit sensitive values, use [an item JSON template](#edit-an-item-using-a-json-template) instead. The `op item edit` command can take a list of assignment statements as arguments to edit an item's [built-in and custom fields](/cli/item-fields). ```shell theme={null} [

.][[]]= ``` * `section` (Optional) The name of the section where the field is saved. * `field` The name of the field. * `fieldType` The type of field. If unspecified, the fieldType stays the same. * `value` The information you want to save in the field. If unspecified, the value stays the same. For example, to change the subscription renewal date on the `HBO Max` item: ```shell theme={null} op item edit "HBO Max" \ 'Renewal Date=2023-5-15' ``` ```powershell theme={null} op item edit "HBO Max" ` 'Renewal Date=2023-5-15' ``` ### Delete a custom field To delete a custom field, specify `[delete]` in place of the fieldType. If you remove all the fields in a section, the section is also removed. You can't delete empty fields, but you can set them to empty strings. To use an assignment statement to delete the subscription renewal date on the example `HBO Max` item: ```shell theme={null} op item edit "HBO Max" \ 'Renewal Date[delete]=2023-5-15' ``` ```powershell theme={null} op item edit "HBO Max" ` 'Renewal Date[delete]=2023-5-15' ``` ## Edit an item using a JSON template JSON item templates do not support passkeys. If you use a JSON template to update an item that contains a passkey, the passkey will be overwritten. To fix this, you can [restore a previous version of the item](https://support.1password.com/item-history/). To edit sensitive values on an item, use an [item JSON template](/cli/item-template-json). 1. Get the JSON output for the item you want to edit and save it to a file. ```shell theme={null} op item get --format json > newItem.json ``` If you prefer to start over, you can get a blank template for the item's category with op item template get. 2. Edit the file. 3. Use the `--template` flag to specify the path to the edited file and apply the changes to the item: ```shell theme={null} op item edit --template=newItem.json ``` 4. Delete the file. You can also edit an item using piped input: ```shell theme={null} cat newItem.json | op item edit ``` To avoid collisions, you can't combine piped input and the `--template` flag in the same command. ## Next steps If you created a Tutorial vault, you can delete the vault and the examples items you created: ```shell theme={null} op vault delete "Tutorial" ``` ## Learn more * [`op item` reference documentation](/cli/reference/management-commands/item) * [Built-in and custom item fields](/cli/item-fields) * [Item JSON template](/cli/item-template-json) * [Workflow: Build integrations with 1Password](/get-started/build-integrations) # Item fields Source: https://www.1password.dev/cli/item-fields When you [use 1Password CLI to create items](/cli/item-create/), you can customize your items with [built-in](#built-in-fields) and [custom](#custom-fields) fields. Learn how to [add built-in and custom fields to your items](/cli/item-create/#create-a-customized-item) with either assignment statements or a JSON template. ## Built-in fields Each item category includes a set of default fields, some of which may be specific to the category. You can identify available built-in fields by looking at the [JSON template](/cli/item-template-json/) for the item category: ``` op item template get ``` * API Credential * Bank Account * Credit Card * Crypto Wallet * Database * Document * Driver License * Email Account * Identity * Login * Medical Record * Membership * Outdoor License * Passport * Password * Reward Program * Secure Note * Server * Social Security Number * Software License * SSH Key * Wireless Router For example, the built-in fields available on a Login item are `username`, `password`, and `notesPlain`. ```shell highlight={6,13,23} theme={null} { "title": "", "category": "LOGIN", "fields": [ { "id": "username", "type": "STRING", "purpose": "USERNAME", "label": "username", "value": "" }, { "id": "password", "type": "CONCEALED", "purpose": "PASSWORD", "label": "password", "password_details": { "strength": "TERRIBLE" }, "value": "" }, { "id": "notesPlain", "type": "STRING", "purpose": "NOTES", "label": "notesPlain", "value": "" } ] } ``` When you use [assignment statements](/cli/item-create/#with-assignment-statements) to assign built-in fields, use the `id` from the JSON template as the `field` in the assignment statement. Don't include a fieldType for built-in fields. For example, to add a note to a Login item using an assignment statement: ```shell theme={null} 'notesPlain=This is a note.' ``` ## Custom fields Custom fields can be added to any item, regardless of the item's category. Use the `fieldType` with [assignment statements](/cli/item-create/#with-assignment-statements) and the `type` with an [item JSON template](/cli/item-create/#with-an-item-json-template). Available custom field types are: | `fieldType` | `type` | description | | ----------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `password` | `CONCEALED` | A concealed password. | | `text` | `STRING` | A text string. | | `email` | `EMAIL` | An email address. | | `url` | `URL` | A web address to copy or open in your default web browser, not used for autofill behavior. Use the `--url` flag to set the website where 1Password suggests and fills a Login, Password, or API Credential item. | | `date` | `DATE` | A date with the format YYYY-MM-DD. | | `monthYear` | `MONTH_YEAR` | A date with the format YYYYMM or YYYY/MM. | | `phone` | `PHONE` | A phone number. | | `otp` | `OTP` | A one-time password. Accepts an [otpauth:// URI](https://github.com/google/google-authenticator/wiki/Key-Uri-Format) as the value. | | `file` | N/A | A file attachment. Accepts the path to the file as the value. Can only be added with [assignment statements](/cli/item-create/#with-assignment-statements). | ## Learn more * [`op item` reference documentation](/cli/reference/management-commands/item/) * [Create an item](/cli/item-create/) * [Item JSON template](/cli/item-template-json/) * [Workflow: Build integrations with 1Password](/get-started/build-integrations) # Item JSON template Source: https://www.1password.dev/cli/item-template-json 1Password CLI supports item JSON templates that you can use to take control of how you create items in 1Password. Item JSON templates allow you to [create an item with all of its details specified](/cli/item-create/#with-an-item-json-template), including custom sections and fields. Item templates are formatted similarly to the JSON output for [`op item get`](/cli/reference/management-commands/item/#item-get), so you can easily create new items based on existing items. Each item category has its own template. You can get a list of all item categories with [`op item template list`](/cli/reference/management-commands/item/#item-template-list). And you can retrieve the template for an item category with [`op item template get `](/cli/reference/management-commands/item/#item-template-get). ## Item template keys Item JSON templates have common language keys that allow you to identify how the fields in the template correspond to the item in 1Password. ```json theme={null} { "title": " ", "category": " ", "sections": [ { "id": " ", "label": " " }, ], "fields": [ { "id": " ", "section": { "id": " " }, "type": " ", "label": " ", "value": " " } ] } ``` **Item** | Name | Description | | ---------- | -------------------------------------------- | | `title` | The name of the item displayed in 1Password. | | `category` | The item's category. | **Section** | Name | Description | | ------- | ------------------------------------------------------------------------------------------ | | `id` | The identifier for the section. If the item has multiple sections, each ID must be unique. | | `label` | The name of the section displayed in 1Password. | To add a custom section, insert a section JSON object into the `sections` array. ```json theme={null} { "id": " ", "label": " " } ``` **Field** | Name | Description | | ------------ | ------------------------------------------------------------------------------------------------------------- | | `id` | The field's ID. Each ID should be unique. If left empty, 1Password will generate a random ID. | | `section id` | The ID of the section where the field is located. Only required if located in a custom section. | | `type` | The field's type. [Learn more about custom field types.](/cli/item-fields/#custom-fields) | | `label` | The name of the field displayed in 1Password. | | `value` | The information saved in the field. Depending on its type, it can be a string, a secret, a number, or a date. | To add a custom field to the template, insert a new field JSON object into the `fields` array. ```json theme={null} { "id": " ", "section": { "id": " " }, "type": " ", "label": " ", "value": " " } ``` ## Example JSON representation This is an item `mysql` in the 1Password app, and the same item represented in an item JSON template.

```json theme={null} { "id": "4l3udxihvvuhszh2kxyjbblxl4", "title": "mysql", "version": 3, "vault": { "id": "uteieiwkhgv6hau7xkorejyvru" }, "category": "DATABASE", "last_edited_by": "IU2OKUBKAFGQPFPFZEG7X3NQ4U", "created_at": "2021-11-25T14:50:14Z", "updated_at": "2022-02-25T18:12:12Z", "sections": [ { "id": "g52gfotnw7nhnkgq477si2hmmi", "label": "Database Owner" } ], "fields": [ { "id": "notesPlain", "type": "STRING", "purpose": "NOTES", "label": "notesPlain" }, { "id": "database_type", "type": "MENU", "label": "type", "value": "mysql" }, { "id": "hostname", "type": "STRING", "label": "server", "value": "http://localhost" }, { "id": "port", "type": "STRING", "label": "port", "value": "5432" }, { "id": "database", "type": "STRING", "label": "database", "value": "app-database" }, { "id": "username", "type": "STRING", "label": "username", "value": "mysql-user" }, { "id": "password", "type": "CONCEALED", "label": "password", "value": "T4Kn7np2bLJXAFoYPoVC" }, { "id": "sid", "type": "STRING", "label": "SID" }, { "id": "alias", "type": "STRING", "label": "alias" }, { "id": "options", "type": "STRING", "label": "connection options" }, { "id": "tpcs7jrjikehw5o4tzbe5pklca", "section": { "id": "g52gfotnw7nhnkgq477si2hmmi", "label": "Database Owner" }, "type": "STRING", "label": "admin", "value": "Wendy Appleseed" }, { "id": "sdqueijyulxryvu5ceuwktjkiq", "section": { "id": "g52gfotnw7nhnkgq477si2hmmi", "label": "Database Owner" }, "type": "EMAIL", "label": "email", "value": "appleseed.wendy@gmail.com" } ] } ``` ## Learn more * [Create an item](/cli/item-create/) * [Work with items](/cli/reference/management-commands/item/) * [Work with vaults](/cli/reference/management-commands/vault/) * [Workflow: Build integrations with 1Password](/get-started/build-integrations) # Add and remove team members Source: https://www.1password.dev/cli/provision-users ## Requirements Before you can use 1Password CLI to add and remove team members, you'll need to: 1. [Sign up for 1Password Business](https://1password.com/pricing/password-manager). 2. [Install 1Password CLI](/cli/get-started/#step-1-install-1password-cli). If you use [automated provisioning hosted by 1Password](https://support.1password.com/provisioning/), you'll also need to [complete a one-time setup](#with-automated-provisioning) before managing users with the CLI. ## Set up provisioning ### With automated provisioning Support for automated provisioning hosted by 1Password is available in [the latest beta build of 1Password CLI](https://app-updates.agilebits.com/product_history/CLI2#beta), version `2.36.0-beta-02` or later. If your account uses [automated provisioning hosted by 1Password](https://support.1password.com/provisioning/), you'll need to run a one-time setup command before you can manage users with the CLI. Skip this section if your account doesn't use automated provisioning. Run `op provisioning configure` with your provisioning token and SCIM URL. The `--token` value must be a [secret reference](/cli/secret-references) that points to the vault, item, and field where your token is stored in your 1Password account (for example, `op://vault-name/item-name/field-name`). The `--url` flag accepts the SCIM URL as plaintext or as a secret reference. For example: ```shell theme={null} op provisioning configure --token --url ``` After you create users with the CLI with automated provisioning enabled, automated provisioning must remain enabled on the account. Users created this way are placed in provisioning-specific states. If automated provisioning is removed from the account, the CLI will return an error when attempting to suspend or reactivate those users. ### With 1Password CLI If you don't use automated provisioning, an owner or administrator must visit the [Provisioning settings page on 1Password.com](https://start.1password.com/settings/provisioning/cli) and select **Turn On CLI Provisioning**. This will create a [Provision Managers](https://support.1password.com/groups/#provision-managers) group with the permissions needed to provision and confirm team members, as well as recover accounts. The person who created the group will be added to it. ## Manage who can provision team members By default, the owner or administrator who created the [Provision Managers](https://support.1password.com/groups/#provision-managers) group is the only person added to it. If other team members need to be able to provision users, use [`op group user grant`](/cli/reference/management-commands/group/#group-user-grant) to add them to the group. For example, to add Wendy Appleseed to the Provision Managers group: ```shell theme={null} op group user grant --group "Provision Managers" --user "wendy.appleseed@agilebits.com" ``` To see a list of everyone in the Provision Managers group: ```shell theme={null} op group user list "Provision Managers" ``` ## Add team members To invite people to your team, use [`op user provision`](/cli/reference/management-commands/user/#user-provision) with the team member's name and email address. For example, to invite Wendy Appleseed to join your 1Password account: ```shell theme={null} op user provision --name "Wendy Appleseed" --email "wendy.appleseed@agilebits.com" ``` The person will receive an email invitation to join the team. After they've accepted the invitation, a member of the Provision Managers group can confirm them. ## Confirm team members If your account uses automated provisioning, users are confirmed automatically. You can skip this section. Anyone who belongs to the [Provision Managers](https://support.1password.com/groups/#provision-managers) group can confirm new team members with [`op user confirm`](#with-op-user-confirm) or [on 1Password.com](#on-1password-com). ### With `op user confirm` To confirm a team member on the command line, use [`op user confirm`](/cli/reference/management-commands/user/#user-confirm) with their name or email address. To confirm all unconfirmed team members, include the `--all` flag. For example, to confirm Wendy Appleseed: ```shell theme={null} op user confirm "wendy.appleseed@agilebits.com" ``` To confirm all pending users: ```shell theme={null} op user confirm --all ``` ### On 1Password.com To confirm a team member on 1Password.com: 1. [Sign in](https://start.1password.com/signin) to your account on 1Password.com. 2. Select **[People](https://start.1password.com/people)** in the sidebar. 3. Select the name of any team member with the Pending Provision status. 4. Select **Confirm** or **Reject**. If you don't see the option to confirm or reject a team member, ask your administrator to [add you to the Provision Managers group](#manage-who-can-provision-team-members). ## Remove team members To remove someone's access to vaults and items, you can suspend or delete their account. ### Suspend an account temporarily Use [`op user suspend`](/cli/reference/management-commands/user/#user-suspend) to suspend a team member temporarily. Include the `--deauthorize-devices-after` flag, followed by the number of seconds, minutes, or hours (for example, `600s`, `10m`, or `1h`) to set the time after suspension to deauthorize the suspended team member's devices. The maximum time permitted is 24 hours. If unspecified, their devices will be deauthorized immediately. If your account uses automated provisioning, the `--deauthorize-devices-after` flag is ignored. The provisioning service always deauthorizes devices after 10 minutes. For example, to suspend Wendy Appleseed temporarily and deauthorize her devices after 10 minutes: ```shell theme={null} op user suspend "wendy.appleseed@agilebits.com --deauthorize-devices-after 10m" ``` You can reactivate a suspended user with [`op user reactivate`](/cli/reference/management-commands/user/#user-reactivate). ### Remove an account permanently Use [`op user delete`](/cli/reference/management-commands/user/#user-delete) to permanently remove a team member's access to vaults and items and delete all of their data from the account. For example, to remove Wendy Appleseed: ```shell theme={null} op user delete "wendy.appleseed@agilebits.com" ``` ## Learn more * [Add and remove team members on 1Password.com](https://support.1password.com/add-remove-team-members/) * [Set up automated provisioning](https://support.1password.com/provisioning/) * [Workflow: Programmatically manage your organization](/get-started/manage-organization) * [Administrator quickstart](/get-started/administrator-quickstart) # Recover accounts using 1Password CLI Source: https://www.1password.dev/cli/recover-users You can use 1Password CLI to begin the account recovery process for a family or team member if they can't sign in to or unlock 1Password. When you recover an account for someone: * They'll receive a new Secret Key and create a new 1Password account password.
If your team uses Unlock with SSO, they'll be able to link a new app or browser to their account again. * They'll be able to access all the data they had before. * They'll need to sign in again on all their devices once recovery is complete. * Their two-factor authentication will be reset. ## Requirements * [Sign up for 1Password](https://1password.com/pricing/password-manager). * [Install 1Password CLI](/cli/get-started#step-1-install-1password-cli) version `2.32.0` or later. You can recover accounts for other people if: * You're a team [administrator](https://support.1password.com/groups/#administrators) or [owner](https://support.1password.com/groups/#owners). * You belong to a [custom group](https://support.1password.com/custom-groups/) that has the "Recover Accounts" permission. * You're a [family organizer](https://support.1password.com/family-organizer/). ## Begin recovery Use the command `op user recovery begin` with a person's name, email address, or [unique identifier (ID)](/cli/reference/#unique-identifiers-ids) to begin the account recovery process. You can recover up to ten accounts with each command. ```shell theme={null} op user recovery begin { | | } ``` For example, to begin recovery for multiple accounts using each person's ID: ```shell theme={null} op user recovery begin ZMAE4RTRONHN7LGELNYYO373KM WHPOFIMMYFFITBVTOTZUR3R324 FGH76DFS89FYCU6342CSDWIFJU ``` The person whose account you're recovering will get an email from 1Password. When they select **Recover my account** in the email, a page will open in their browser and they'll be asked to confirm their email address. Then they'll get a new Secret Key and create a new account password. ## Complete recovery After the person whose account you recovered creates a new account password, you'll need to complete the recovery process before they can access their account. Learn how to [complete account recovery for one or more people](https://support.1password.com/recovery/#complete-recovery). ## Learn more * [Add and remove team members](/cli/provision-users) * [Grant and revoke vault permissions](/cli/grant-revoke-vault-permissions) * [Sign back in to 1Password after your account has been recovered](https://support.1password.com/after-recovery/) * [Workflow: Programmatically manage your organization](/get-started/manage-organization) * [Administrator quickstart](/get-started/administrator-quickstart) # 1Password CLI reference Source: https://www.1password.dev/cli/reference **Get started** If you're new to 1Password CLI, [learn how to set it up and sign in to your account](/cli/get-started/). ## Command structure ``` op [command] ``` 1Password CLI uses a noun-verb command structure that groups commands by topic rather than by operation. The basic structure of a command starts with the 1Password program `op`, then the `command name (noun)`, often followed by a `subcommand (verb)`, then `flags` (which include additional information that gets passed to the command). For example, to retrieve a list of all the items in your Private vault: ```shell theme={null} op item list --vault Private ``` To get a list of all global commands and flags, run the following: ```shell theme={null} op --help ``` ## Command reference * [account](/cli/reference/management-commands/account): Manage your locally configured 1Password accounts * [completion](/cli/reference/commands/completion): Generate shell completion information * [connect](/cli/reference/management-commands/connect): Manage Connect server instances and tokens in your 1Password account * [document](/cli/reference/management-commands/document): Perform CRUD operations on Document items in your vaults * [environment](/cli/reference/management-commands/environment): Manage your 1Password Environments and their variables (Beta) * [events-api](/cli/reference/management-commands/events-api): Manage Events API integrations in your 1Password account * [group](/cli/reference/management-commands/group): Manage the groups in your 1Password account * [inject](/cli/reference/commands/inject): Inject secrets into a config file * [item](/cli/reference/management-commands/item): Perform CRUD operations on the 1Password items in your vaults * [plugin](/cli/reference/management-commands/plugin): Manage the shell plugins you use to authenticate third-party CLIs * [read](/cli/reference/commands/read): Read a secret reference * [run](/cli/reference/commands/run): Pass secrets as environment variables to a process * [service-account](/cli/reference/management-commands/service-account): Manage service accounts * [signin](/cli/reference/commands/signin): Sign in to a 1Password account * [signout](/cli/reference/commands/signout): Sign out of a 1Password account * [update](/cli/reference/commands/update): Check for and download updates * [user](/cli/reference/management-commands/user): Manage users within this 1Password account * [vault](/cli/reference/management-commands/vault): Manage permissions and perform CRUD operations on your 1Password vaults * [whoami](/cli/reference/commands/whoami): Get information about a signed-in account ## Global flags ``` --account string Select the account to execute the command by account shorthand, sign-in address, account ID, or user ID. For a list of available accounts, run 'op account list'. Can be set as the OP_ACCOUNT environment variable. --cache Store and use cached information. Caching is enabled by default on UNIX-like systems. Caching is not available on Windows. Options: true, false. Can also be set with the OP_CACHE environment variable. (default true) --config directory Use this configuration directory. --debug Enable debug mode. Can also be enabled by setting the OP_DEBUG environment variable to true. --encoding type Use this character encoding type. Default: UTF-8. Supported: SHIFT_JIS, gbk. --format string Use this output format. Can be 'human-readable' or 'json'. Can be set as the OP_FORMAT environment variable. (default "human-readable") -h, --help Get help for op. --iso-timestamps Format timestamps according to ISO 8601 / RFC 3339. Can be set as the OP_ISO_TIMESTAMPS environment variable. --no-color Print output without color. --session token Authenticate with this session token. 1Password CLI outputs session tokens for successful `op signin` commands when 1Password app integration is not enabled. ``` ## Unique identifiers (IDs) When you retrieve information about an object using the `get` and `list` subcommands, you'll see a string of 26 numbers and letters that make up the object's unique identifier (ID). You can use names or IDs in commands that take any [account](/cli/reference/management-commands/account/#account-get), [user](/cli/reference/management-commands/user/#user-get), [vault](/cli/reference/management-commands/vault/#vault-get), or [item](/cli/reference/management-commands/item/#item-get) as an argument. IDs are the most stable way to reference an item. An item's ID only changes when you move the item to a different vault. Commands provided with an ID are also faster and more efficient. You can get information about an item, including the item's ID and the ID for the vault where it's stored, with [`op item get`](/cli/reference/management-commands/item#item-get). ```shell theme={null} op item get Netflix #code-result ID: t2Vz6kMDjByzEAcq6peKnHL4k3 Title: Netflix Vault: Private (sdfsdf7werjgdf8gdfgjdfgkj) Created: 6 months ago Updated: 1 month ago by Wendy Appleseed Favorite: false Version: 1 Category: LOGIN ``` To only fetch the item ID, use the same command with the format set to JSON, then use [jq ](https://jqlang.github.io/jq/) to parse the output. ```shell theme={null} op item get Netflix --format json | jq .id #code-result "t2Vz6kMDjByzEAcq6peKnHL4k3" ``` To get the IDs for all vaults in an account: ```shell theme={null} op vault list #code-result ID NAME cfqtakqiutfhiewomztljx4woy Development rr3ggvrlr6opoete23q7c22ahi Personal 2gq6v6vzorl7jfxdurns4hl66e Work ``` ## Shell completion You can add shell completion so that 1Password CLI automatically completes your commands. With shell completion enabled, start typing an `op` command, then press Tab to see the available commands and options. To enable shell completion with Bash: 1. Install the bash-completion package 2. Add this line to your `.bashrc` file: ``` source <(op completion bash) ``` To enable shell completion with Zsh, add this line to your `.zshrc` file: ``` eval "$(op completion zsh)"; compdef _op op ``` To enable shell completion with fish, add this to your `.fish` file: ``` op completion fish | source ``` To enable shell completion with PowerShell, add this to your `.ps1` file: ```powershell theme={null} op completion powershell | Out-String | Invoke-Expression ``` You'll need to enable script execution in PowerShell to start using shell completion. To do that, start a PowerShell window as an administrator and enter: ```powershell theme={null} Set-ExecutionPolicy -ExecutionPolicy RemoteSigned ``` ## Cache item and vault information 1Password CLI can use its daemon process to cache items, vault information, and the keys to access information in an account. The daemon stores encrypted information in memory using the same encryption methods as on 1Password.com. It can read the information to pass to 1Password CLI, but can’t decrypt it. On UNIX-like systems, caching between commands is enabled by default. This helps maximize performance and reduce the number of API calls. If you use 1Password CLI in an environment where caching is not possible, you can turn it off by appending the `--cache=false` flag to your commands, or by setting the `OP_CACHE` environment variable to false. Caching is not currently available on Windows. ## Alternative character encoding By default, 1Password CLI processes input and output with UTF-8 encoding. You can use an alternative character encoding with the `--encoding` option. Supported alternative character encoding types: * `gbk` * `shift-jis` ## Parse JSON output with jq You can use the `--format` flag or the `OP_FORMAT` environment variable to set your 1Password CLI command output to `json`. To parse JSON output, we recommend using the command-line tool [jq. ](https://jqlang.github.io/jq/) For example, to use jq to retrieve a secret reference for the password saved on an item named `GitHub`: ```shell theme={null} op item get GitHub --format json --fields password | jq .reference #code-result "op://development/GitHub/password" ``` ## Beta builds To download 1Password CLI beta builds, navigate to the [1Password CLI downloads page](https://app-updates.agilebits.com/product_history/CLI2#beta) with the **Show betas** option selected. On Linux, you can switch the channel from "stable" to "beta" when adding the 1Password repository in your package manager. ## Example commands ### Items To get information about an item: ```shell theme={null} op item get ``` You'll see the item's [ID](#unique-identifiers-ids), title, vault, when it was created, when it was last modified, the item's version, if it's marked as a favorite, the type of item it is, and the item's fields. If an item name includes spaces or special characters, enclose it in quotes. For example: ```shell theme={null} op item get "work email" #code-result ID: a5w3is43ohs25qonzajrqaqx4q Title: work email Vault: Work (2gq6v6vzorl7jfxdurns4hl66e) Created: 6 years ago Updated: 9 months ago by Wendy Appleseed Favorite: true Version: 1 Category: LOGIN Fields: username: wendy.c.appleseed@agilebits.com password: NLuXcEtg27JMjGmiBHXZMGCgce URLs: website: https://www.gmail.com (primary) ``` To use `op item get` to retrieve specific fields, include the `--fields` flag followed by a comma-separated list, with the prefix `label=` before each field name. For example, to only retrieve the username and password for the item `work email`: ```shell theme={null} op item get "work email" --fields label=username,label=password #code-result wendy.c.appleseed@agilebits.com,NLuXcEtg27JMjGmiBHXZMGCgce ``` Learn more about working with [items](/cli/reference/management-commands/item/). ### Users and groups To get details about a user: ```shell theme={null} op user get "Wendy Appleseed" #code-result ID: SPRXJFTDHTA2DDTPE5F7DA64RQ Name: Wendy Appleseed Email: wendy.c.appleseed@agilebits.com State: ACTIVE Type: MEMBER Created: 6 years ago Updated: 4 months ago Last Authentication: 1 month ago ``` To list the users who belong to a group: ``` op group user list "Provision Managers" #code-result ID NAME EMAIL STATE TYPE ROLE 7YEOODASGJE6VAEIOHYWGP33II Wendy Appleseed wendy.c.appleseed@agilebits.com ACTIVE MEMBER UKCYFVOJSFEXLKKZREG7M2MZWM Johnny Appleseed johnny.appleseed@agilebits.com RECOVERY_STARTED MEMBER ``` Learn more about working with [users](/cli/reference/management-commands/user/) and [groups](/cli/reference/management-commands/group/). ### Vaults To create a new vault named `Test`: ```shell theme={null} op vault create Test ``` To get details about an existing vault: ```shell theme={null} op vault get Work #code-result ID: jAeq2tfunmifZfG4WkuWvsaGGj Name: Work Type: USER_CREATED Attribute version: 3 Content version: 241 Items: 25 Created: 1 year ago Updated: 1 month ago ``` To list the vaults in an account: ```shell theme={null} op vault list #code-result ID NAME vw8qjYEvsdCcZoULJRCqopy7Rv Development 2RNjh43dpHB9sDqZXEHiiw7zTe Personal cGxbZbV2pxKBmVJe9oWja4K8km Work ``` Learn more about working with [vaults](/cli/reference/management-commands/vault/). ### Secrets To insert a secret into an environment variable, config file, or script without putting the plaintext secret in code, use a [secret reference](/cli/secret-reference-syntax/) that specifies where the secret is stored in your 1Password account: ``` op://vault-name/item-name/[section-name/]field-name ``` Then, you can use [`op read`](/cli/reference/commands/read/), [`op run`](/cli/reference/commands/run/), or [`op inject`](/cli/reference/commands/inject/) to replace the secret reference with the actual secret at runtime. To resolve a secret reference and confirm it outputs correctly: ```shell theme={null} op read "op://Work/work email/username" #code-result wendy.c.appleseed@agilebits.com ``` Learn more about [loading secrets](/cli/secret-references/). ## Get help For help with any command, use the `--help` option: ``` op [subcommand] --help ``` # completion Source: https://www.1password.dev/cli/reference/commands/completion Generate shell completion information for 1Password CLI. ```shell theme={null} op completion [flags] ``` If you use Bash, Zsh, fish, or PowerShell, you can add shell completion for 1Password CLI. With completions loaded, after you start typing a command, press Tab to see available commands and options. #### Load shell completion information for Bash To always load the completion information for Bash, add this to your `.bashrc` file: ```shell theme={null} source <(op completion bash) ``` To use shell completion in Bash, you’ll need the `bash-completion` package. #### Load shell completion information for Zsh To always load the completion information for Zsh, add this to your `.zshrc` file: ```shell theme={null} eval "$(op completion zsh)"; compdef _op op ``` #### Load shell completion information for fish To always load the completion information for fish, add this to your `.fish` file: ```shell theme={null} op completion fish | source ``` #### Load shell completion information for PowerShell To always load the completion information for PowerShell, add this to your `.ps1` file: ```powershell theme={null} op completion powershell | Out-String | Invoke-Expression ``` To use shell completion in PowerShell, you need to enable execution of scripts. To do that, start a PowerShell window as administrator and run the following command: ```powershell theme={null} Set-ExecutionPolicy -ExecutionPolicy RemoteSigned ``` # inject Source: https://www.1password.dev/cli/reference/commands/inject Inject secrets into a file templated with secret references. ``` op inject [flags] ``` ### Flags ``` --file-mode filemode Set filemode for the output file. It is ignored without the --out-file flag. (default 0600) -f, --force Do not prompt for confirmation. -i, --in-file string The filename of a template file to inject. -o, --out-file string Write the injected template to a file instead of stdout. ``` [Learn more about secret references.](/cli/secret-references) You can pass in a config file templated with secret references and receive a config file with the actual secrets substituted. Make sure to delete the resolved file when you no longer need it. [Learn more about loading secrets into config files.](/cli/secrets-config-files) ### Examples Inject secrets into a config template from stdin: ``` echo "db_password: {{ op://app-prod/db/password }}" | op inject db_password: fX6nWkhANeyGE27SQGhYQ ``` Inject secrets into a config template file: ``` cat config.yml.tpl db_password: {{ op://app-prod/db/password }} ``` ``` op inject -i config.yml.tpl -o config.yml && cat config.yml db_password: fX6nWkhANeyGE27SQGhYQ ``` Multiple secrets can be concatenated: ``` echo "db_url: postgres://{{ op://lcl/db/user }}:{{ op://lcl/db/pw }}@{{ op://lcl/db/host }}:{{ op://lcl/db/port }}/{{ op://my-app-prd/db/db }}" | op inject db_url: postgres://admin:admin@127.0.0.1:5432/my-app" ``` Use variables in secret references to switch between different sets of secrets for different environments: ``` echo "db_password: op://$env/db/password" | env=prod op inject db_password: fX6nWkhANeyGE27SQGhYQ ``` # read Source: https://www.1password.dev/cli/reference/commands/read Read the value of the field in 1Password specified by a secret reference. [Learn more about secret references and query parameters.](/cli/secret-reference-syntax/) ``` op read [flags] ``` ### Flags ``` --file-mode filemode Set filemode for the output file. It is ignored without the --out-file flag. (default 0600) -f, --force Do not prompt for confirmation. -n, --no-newline Do not print a new line after the secret. -o, --out-file string Write the secret to a file instead of stdout. ``` ### Examples Print the secret saved in the field `password`, on the item `db`, in the vault `app-prod`: ```shell theme={null} op read op://app-prod/db/password ``` Use a secret reference with a query parameter to retrieve a one-time password: ```shell theme={null} op read "op://app-prod/db/one-time password?attribute=otp" ``` Use a secret reference with a query parameter to get an SSH key's private key in the OpenSSH format: ```shell theme={null} op read "op://app-prod/ssh key/private key?ssh-format=openssh" ``` Save the SSH key found on the item `ssh` in the `server` vault as a new file `key.pem` on your computer: ```shell theme={null} op read --out-file ./key.pem op://app-prod/server/ssh/key.pem ``` Use `op read` in a command with secret references in place of plaintext secrets: ```shell theme={null} docker login -u $(op read op://prod/docker/username) -p $(op read op://prod/docker/password) ``` # run Source: https://www.1password.dev/cli/reference/commands/run Pass secrets as environment variables to an application or script. ``` op run -- ... [flags] ``` ### Flags ``` --env-file stringArray Enable Dotenv integration with specific Dotenv files to parse. For example: --env-file=.env. --no-masking Disable masking of secrets on stdout and stderr. ``` Use `op run` to securely load project secrets from 1Password, then run a provided command in a subprocess with the secrets made available as environment variables only for the duration of the subprocess. To limit which 1Password items processes in your authorized terminal session can access, make sure to authenticate 1Password CLI with a service account that only has access to the required secrets. You can scope service accounts to specific vaults and 1Password Environments. [Learn more about service accounts.](/service-accounts/) [Learn more about loading secrets with `op run`.](/cli/secrets-environment-variables) #### Load secrets using secret references `op run` can scan environment variables and files for secret references, then load the provided command with the referenced secrets made available as environment variables. Secret references are URIs that point to the ID or name of the vault, item, section, and field where a secret is stored in 1Password. You can export environment variables to secret references on the command line or using an .env file. Secrets printed to stdout or stderr are concealed by default. Include the `--no-masking` flag to turn off masking. When referencing an environment variable assigned to a secret reference within a command, `op run` must replace the reference with the actual secret value before the variable expands. To make sure this order of operations is followed, run the command that expands the variable in a subshell. #### Load variables from Environments (beta) The `--environments` flag is available in [the latest beta build of 1Password CLI](https://app-updates.agilebits.com/product_history/CLI2#beta), version `2.33.0-beta.02` or later. Use `op run` with the `--environments` flag and an Environment's ID to load variables from a 1Password Environment. To find an Environment's ID, open the 1Password app, navigate to Developer > View Environments > then select View environment > Manage environment > Copy environment ID. Load variables from a 1Password Environment: ```shell theme={null} op run --environment -- printenv ``` #### Environment variable precedence If the same environment variable name exists in multiple sources, the source with higher precedence takes effect. Precedence from highest to lowest: 1. 1Password Environments (--environment) 2. Environment files (--env-file) 3. Shell environment variables If the same environment variable name exists in multiple environment files, the last environment file takes precedence. If the same environment variable name exists in multiple 1Password Environments, the last Environment specified takes precedence. ### Examples Print secret value: ``` export DB_PASSWORD="op://app-prod/db/password" ``` ``` op run -- printenv DB_PASSWORD ``` ``` op run --no-masking -- printenv DB_PASSWORD fX6nWkhANeyGE27SQGhYQ ``` Specify an environment file and use it: ``` echo "DB_PASSWORD=op://app-dev/db/password" > .env ``` ``` op run --env-file="./.env" -- printenv DB_PASSWORD password ``` Use variables in secret references to switch between different sets of secrets for different environments: ``` cat .env DB_USERNAME = op://$APP_ENV/db/username DB_PASSWORD = op://$APP_ENV/db/password ``` ``` export APP_ENV="dev" op run --env-file="./.env" -- printenv DB_PASSWORD dev ``` ``` export APP_ENV="prod" op run --env-file="./.env" -- printenv DB_PASSWORD prod ``` # signin Source: https://www.1password.dev/cli/reference/commands/signin Sign in to 1Password CLI using the 1Password desktop app. ```shell theme={null} op signin [flags] ``` ### Flags ``` -f, --force Ignore warnings and print raw output from this command. --raw Only return the session token. ``` To turn on the 1Password app integration: 1. Open the 1Password app. 2. Navigate to **Settings** > **Security** and turn on Touch ID, Windows Hello, or a Linux system authentication option. 3. Navigate to **Developer** > **Settings** and select **Integrate with 1Password CLI**. [Learn more about the app integration.](/cli/app-integration/) If you add multiple 1Password accounts to the 1Password app, 1Password CLI determines which to use in this order: 1. The account specified with the `--account` flag. 2. The account specified by the `OP_ACCOUNT` environment variable. 3. The account you most recently signed in to with `op signin` in any terminal window. `op signin` is idempotent. It only prompts for authentication if you aren't already authenticated. ### Examples Sign in and set the environment variable in one step: ```shell theme={null} eval $(op signin --account acme.1password.com) ``` # signout Source: https://www.1password.dev/cli/reference/commands/signout Sign out of a 1Password account. ``` op signout [flags] ``` ### Flags ``` --all Sign out of all signed-in accounts. --forget Remove the details for a 1Password account from this device. ``` Signs out of the most recently used account by default. # update Source: https://www.1password.dev/cli/reference/commands/update Check for updates to `op` and download an updated version, if available. ``` op update [flags] ``` ### Flags ``` --directory path Download the update to this path. --channel string Look for updates from a specific channel. allowed: stable, beta ``` # whoami Source: https://www.1password.dev/cli/reference/commands/whoami Get information about a signed-in account. ``` op whoami [flags] ``` Returns the currently active account or service account. The command returns an error if no accounts are currently authenticated. Get information about a specific account with the `--account ` flag. # account Source: https://www.1password.dev/cli/reference/management-commands/account Manage your locally configured 1Password accounts. ### Subcommands * [account add](#account-add): Add an account to sign in to for the first time * [account forget](#account-forget): Remove a 1Password account from this device * [account get](#account-get): Get details about your account * [account list](#account-list): List users and accounts set up on this device ## account add Add a new 1Password account to 1Password CLI manually with your account password and Secret Key, instead of [signing in using your 1Password app](/cli/app-integration/). ```shell theme={null} op account add [flags] ``` ### Flags ``` --address string The sign-in address for your account. --email string The email address associated with your account. --raw Only return the session token. --shorthand string Set a custom account shorthand for your account. --signin Immediately sign in to the added account. ``` To sign in to manually-added accounts: ```shell theme={null} eval $(op signin) ``` ```powershell theme={null} Invoke-Expression $(op signin) ``` [Learn more about signing in manually.](/cli/sign-in-manually/) When you sign in manually, 1Password CLI creates a session token and sets the `OP_SESSION` environment variable to it. Session tokens expire after 30 minutes of inactivity, after which you’ll need to sign in again. If you add multiple 1Password accounts, 1Password CLI determines which to use in this order: 1. An account specified with the `--account` flag. 2. An account specified with the `OP_ACCOUNT` environment variable. 3. The account most recently signed in to with `op signin` in the current terminal window. ### Examples Add an account using flags to specify account details: ```shell theme={null} op account add --address my.1password.com --email user@example.org ``` Add an account and immediately sign in to it: ```shell theme={null} eval $(op account add --signin) ``` ```powershell theme={null} Invoke-Expression $(op account add --signin) ``` Sign in to a specific account: ```shell theme={null} eval $(op signin --account my) ``` ```powershell theme={null} Invoke-Expression $(op signin --account my) ``` ## account forget Remove a 1Password account from this device. ``` op account forget [ ] [flags] ``` ### Flags ``` --all Forget all authenticated accounts. ``` ## account get Get details about your account. ``` op account get [flags] ``` ## account list List users and accounts set up on this device. ``` op account list [flags] ``` # connect Source: https://www.1password.dev/cli/reference/management-commands/connect Manage Connect server instances and tokens in your 1Password account. Looking up a Connect server by its [ID](/cli/reference#unique-identifiers-ids) is more efficient than using the Connect server's name. ### Subcommands * [connect group](#connect-group): Manage group access to Secrets Automation * [connect server](#connect-server): Manage Connect servers * [connect token](#connect-token): Manage Connect server tokens * [connect vault](#connect-vault): Manage Connect server vault access ## connect group ### Subcommands * [connect group grant](#connect-group-grant): Grant a group access to manage Secrets Automation * [connect group revoke](#connect-group-revoke): Revoke a group's access to manage Secrets Automation ## connect group grant Grant a group access to manage Secrets Automation. ``` op connect group grant [flags] ``` ### Flags ``` --all-servers Grant access to all current and future servers in the authenticated account. --group group The group to receive access. --server server The server to grant access to. ``` If you don't specify a server, it adds the group to the list of Secrets Automation managers. ## connect group revoke Revoke a group's access to manage Secrets Automation. ``` op connect group revoke [flags] ``` ### Flags ``` --all-servers Revoke access to all current and future servers in the authenticated account. --group group The group to revoke access from. --server server The server to revoke access to. ``` ## connect server ### Subcommands * [connect server create](#connect-server-create): Set up a Connect server * [connect server delete](#connect-server-delete): Remove a Connect server * [connect server edit](#connect-server-edit): Rename a Connect server * [connect server get](#connect-server-get): Get a Connect server * [connect server list](#connect-server-list): List Connect servers ## connect server create Add a 1Password Connect server to your account and generate a credentials file for it. 1Password CLI saves the `1password-credentials.json` file in the current directory. Note: You can't grant a Connect server access to your built-in [Personal](https://support.1password.com/1password-glossary/#personal-vault), [Private](https://support.1password.com/1password-glossary/#private-vault), or [Employee](https://support.1password.com/1password-glossary/#employee-vault) vault. ``` op connect server create [flags] ``` ### Flags ``` -f, --force Do not prompt for confirmation when overwriting credential files. --vaults strings Grant the Connect server access to these vaults. ``` 1Password CLI saves the `1password-credentials.json` file in the current directory. ## connect server delete Remove a Connect server. Specify the server by name or ID. ``` op connect server delete [{ | | - }] [flags] ``` The credentials file and all the tokens for the server will no longer be valid. ## connect server edit Rename a Connect server. Specify the server by name or ID. ``` op connect server edit { | } [flags] ``` ### Flags ``` --name name Change the server's name. ``` ## connect server get Get details about a Connect server. Specify the server by name or ID. ``` op connect server get [{ | | - }] [flags] ``` ## connect server list Get a list of Connect servers. ``` op connect server list [flags] ``` ## connect token ### Subcommands * [connect token create](#connect-token-create): Issue a token for a 1Password Connect server * [connect token delete](#connect-token-delete): Revoke a token for a Connect server * [connect token edit](#connect-token-edit): Rename a Connect server token * [connect token list](#connect-token-list): Get a list of tokens ## connect token create Issue a new token for a Connect server. ``` op connect token create [flags] ``` ### Flags ``` --expires-in duration Set how long the Connect token is valid for in (s)econds, (m)inutes, (h)ours, (d)ays, and/or (w)eeks. --server string Issue a token for this server. --vault stringArray Issue a token on these vaults. ``` Returns a token. You can only provision Connect server tokens to vaults that the Connect server has access to. Use `op connect vault grant` to grant access to vaults. Note: You can't grant a Connect server access to your built-in [Personal](https://support.1password.com/1password-glossary/#personal-vault), [Private](https://support.1password.com/1password-glossary/#private-vault), or [Employee](https://support.1password.com/1password-glossary/#employee-vault) vault. By default, the `--vaults` option grants the same permissions as the server. To further limit the permissions a token has to read-only or write-only, add a comma and `r` or `w` after the vault specification. For example: ``` op connect token create "Dev k8s token" --server Dev --vaults Kubernetes,r \ --expires-in=30d ``` ``` op connect token create "Prod: Customer details" --server Prod --vault "Customers,w" \ --vault "Vendors,r" ``` ## connect token delete Revoke a token for a Connect server. ``` op connect token delete [ ] [flags] ``` ### Flags ``` --server string Only look for tokens for this 1Password Connect server. ``` ## connect token edit Rename a Connect server token. ``` op connect token edit [flags] ``` ### Flags ``` --name string Change the token's name. --server string Only look for tokens for this 1Password Connect server. ``` ## connect token list List tokens for Connect servers. ``` op connect token list [flags] ``` ### Flags ``` --server server Only list tokens for this Connect server. ``` Returns both active and revoked tokens. The `integrationId` is the ID for the Connect server the token belongs to. ## connect vault ### Subcommands * [connect vault grant](#connect-vault-grant): Grant a Connect server access to a vault * [connect vault revoke](#connect-vault-revoke): Revoke a Connect server's access to a vault ## connect vault grant Grant a Connect server access to a vault. ``` op connect vault grant [flags] ``` Note: You can't grant a Connect server access to your built-in [Personal](https://support.1password.com/1password-glossary/#personal-vault), [Private](https://support.1password.com/1password-glossary/#private-vault), or [Employee](https://support.1password.com/1password-glossary/#employee-vault) vault. ### Flags ``` --server string The server to be granted access. --vault string The vault to grant access to. ``` ## connect vault revoke Revoke a Connect server's access to a vault. ``` op connect vault revoke [flags] ``` ### Flags ``` --server server The server to revoke access from. --vault vault The vault to revoke a server's access to. ``` # document Source: https://www.1password.dev/cli/reference/management-commands/document Perform CRUD operations on Document items in your vaults. ### Subcommands * [document create](#document-create): Create a document item * [document delete](#document-delete): Delete or archive a document item * [document edit](#document-edit): Edit a document item * [document get](#document-get): Download a document * [document list](#document-list): Get a list of documents ## document create Create a document item and receive a JSON object that contains the item's ID. ``` op document create [{ | - }] [flags] ``` ### Flags ``` --file-name name Set the file's name. --tags tags Set the tags to the specified (comma-separated) values. --title title Set the document item's title. --vault vault Save the document in this vault. Default: Private. ``` By default, the document is saved in your built-in [Personal](https://support.1password.com/1password-glossary/#personal-vault), [Private](https://support.1password.com/1password-glossary/#private-vault), or [Employee](https://support.1password.com/1password-glossary/#employee-vault) vault. Specify a different vault with the `--vault` option. #### Create a file from standard input To create the file contents from standard input (stdin), enter a hyphen (`-`) instead of a path. You can use the `--file-name` option to change the name of the file. ### Examples Create a document by specifying the file path: ``` op document create "../demos/videos/demo.mkv" --title "2020-06-21 Demo Video" ``` Create a document from standard input: ``` cat auth.log.* | op document create - --title "Authlogs 2020-06" --file-name "auth.log.2020.06" ``` ## document delete Permanently delete a document. Specify the document to delete by its name or ID. Use the `--archive` option to move it to the Archive instead. ``` op document delete [{ | | - }] [flags] ``` ### Flags ``` --archive Move the document to the Archive. --vault vault Delete the document in this vault. ``` #### Specify items on standard input The command treats each line of information on standard input (stdin) as an object specifier. Run `op help` to learn more about how to specify objects. You can also input a list or array of JSON objects. The command will get an item for any object that has an ID. This is useful for passing information from one `op` command to another. ### Examples Permanently delete a document: ``` op document delete "2019 Contracts" ``` Move a document to the Archive: ``` op document delete "2019 Contracts" --archive ``` ## document edit Edit a document item. Specify the document item to edit by its name or ID. ``` op document edit { | } [{ | - }] [flags] ``` ### Flags ``` --file-name name Set the file's name. --tags tags Set the tags to the specified (comma-separated) values. An empty value removes all tags. --title title Set the document item's title. --vault vault Look up document in this vault. ``` Replaces the file contents of a Document item with the provided file or with the information on standard input (stdin). #### Update a file from standard input To update the file contents from standard input (stdin), enter a hyphen (`-`) instead of a path. You can use the `--file-name` option to change the name of the file. ## document get Download a document and print the contents. Specify the document by its name or ID. ``` op document get { | } [flags] ``` ### Flags ``` --file-mode filemode Set filemode for the output file. It is ignored without the --out-file flag. (default 0600) --force Forcibly print an unintelligible document to an interactive terminal. If --out-file is specified, save the document to a file without prompting for confirmation. --include-archive Include document items in the Archive. Can also be set using OP_INCLUDE_ARCHIVE environment variable. -o, --out-file path Save the document to the file path instead of stdout. --vault vault Look for the document in this vault. ``` Prints to standard output (stdout) by default. To print to a file, use the `--out-file path/to/file.ext` flag. #### Save to a file Use the `--out-file` option to have `op` save the document. This may be useful in some shells as a way to preserve the file's original encoding. The `--out-file` option won't overwrite an existing file. The destination path must be an empty file or not exist. ### Examples Save a document to a file called `secret-plans.text`: ``` op document get "Top Secret Plan B" --out-file=../documents/secret-plans.text ``` ## document list List documents. ``` op document list [flags] ``` ### Flags ``` --include-archive Include document items in the Archive. Can also be set using OP_INCLUDE_ARCHIVE environment variable. --vault vault Only list documents in this vault. ``` Returns a list of all documents the account has read access to by default. Excludes items in the Archive by default. # environment Source: https://www.1password.dev/cli/reference/management-commands/environment The `--environments` flag is available in [the latest beta build of 1Password CLI](https://app-updates.agilebits.com/product_history/CLI2#beta), version `2.33.0-beta.02` or later. [1Password Environments](/environments) allow you to organize and manage your project's environment variables, separately from the rest of the items in your 1Password vaults. You can create an Environment for each project or development stage, then securely access your variables directly from 1Password when you need them. ### Subcommands * [environment read](#environment-read): Read environment variables from a 1Password Environment ## environment read Read environment variables from a 1Password Environment. ```shell theme={null} op environment read [flags] ``` Specify the 1Password Environment by its ID. To find an Environment's ID, open the 1Password app, navigate to **Developer** > **View Environments** > then select **View environment** > **Manage environment** > **Copy environment ID**. ### Examples Read variables from a 1Password Environment: ```shell theme={null} op environment read ``` # events-api Source: https://www.1password.dev/cli/reference/management-commands/events-api Manage Events API integrations in your 1Password account. Requires a business account. ### Subcommands * [events-api create](#events-api-create): Set up an integration with the Events API ## events-api create Create an Events API integration token. ``` op events-api create [flags] ``` ### Flags ``` --expires-in duration Set how the long the events-api token is valid for in (s)econds, (m)inutes, (h)ours, (d)ays, and/or (w)eeks. --features features Set the comma-separated list of features the integration token can be used for. Options: `signinattempts`, `itemusages`, `auditevents`. ``` 1Password CLI prints the token when successful. Requires a business account. ### Examples Create an Events API integration to report sign-in attempts that expires in one hour: ``` op events-api create SigninEvents --features signinattempts --expires-in 1h ``` Create an Events API integration that reports all supported events that does not expire: ``` op events-api create AllEvents ``` # group Source: https://www.1password.dev/cli/reference/management-commands/group Manage the groups in your 1Password account. Groups can be used to organize your team and delegate administrative responsibilities. You can give groups access to vaults and assign them permissions, so you don't have to keep track of everyone separately. ### Subcommands * [group create](#group-create): Create a group * [group delete](#group-delete): Remove a group * [group edit](#group-edit): Edit a group's name or description * [group get](#group-get): Get details about a group * [group list](#group-list): List groups * [group user](#group-user): Manage group membership ## group create Create a group and receive a JSON object with the group's ID. ``` op group create [flags] ``` ### Flags ``` --description string Set the group's description. ``` ## group delete Remove a group. Specify the group to delete by its name or ID. ``` op group delete [{ | | - }] [flags] ``` ## group edit Edit a group's name or description. Specify the group to edit by its name or ID. ``` op group edit [{ | | - }] [flags] ``` ### Flags ``` --description description Change the group's description. --name name Change the group's name. ``` ## group get Get details about a group. Specify the group by its name or ID. ``` op group get [{ | | - }] [flags] ``` #### Use standard input to specify objects If you enter a hyphen (`-`) instead of a single object for this command, the tool will read object specifiers from standard input (stdin). Separate each specifier with a new line. For more information about how to specify objects, run `op help`. You can also pass the command a list or array of JSON objects. The tool will get an item for any object that has an ID, ignoring line breaks. This is useful for passing information from one `op` command to another. ### Examples Get details for all groups: ``` op group list --format=json | op group get - ``` Get details for the groups who have access to a vault: ``` op group list --vault "Production keys" --format=json | op group get - ``` ## group list List groups. ``` op group list [flags] ``` ### Flags ``` --user user List groups that a user belongs to. --vault vault List groups that have direct access to a vault. ``` Returns all groups in an account by default. ### Examples Get details for all groups: ``` op group list | op group get - ``` Get details for the groups that have access to a vault: ``` op group list --vault Staging --format=json | op group get - ``` Get details for the groups that a user belongs to: ``` op group list --user wendy_appleseed@1password.com --format=json | op group get - ``` ## group user ### Subcommands * [group user grant](#group-user-grant): Add a user to a group * [group user list](#group-user-list): Retrieve users that belong to a group * [group user revoke](#group-user-revoke): Remove a user from a group ## group user grant Grant a user access to a group. ``` op group user grant [flags] ``` ### Flags ``` --group string Specify the group to grant the user access to. --role string Specify the user's role as a member or manager. Default: member. --user string Specify the user to grant group access to. ``` ## group user list Retrieve users that belong to a group. ``` op group user list [flags] ``` ## group user revoke Revoke a user's access to a group. ``` op group user revoke [flags] ``` ### Flags ``` --group string Specify the group to remove the user from. --help Get help with group user revoke. --user string Specify the user to remove from the group. ``` # item Source: https://www.1password.dev/cli/reference/management-commands/item Perform CRUD operations on the 1Password items in your vaults. ### Subcommands * [item create](#item-create): Create an item * [item delete](#item-delete): Delete or archive an item * [item edit](#item-edit): Edit an item's details * [item get](#item-get): Get an item's details * [item list](#item-list): List items * [item move](#item-move): Move an item between vaults * [item share](#item-share): Share an item * [item template](#item-template): Manage templates ## item create Create a new item. ``` op item create [ - ] [ ... ] [flags] ``` ### Flags ``` --category category Set the item's category. --dry-run Test the command and output a preview of the resulting item. --favorite Add item to favorites. --generate-password[=recipe] Add a randomly-generated password to a Login or Password item. --reveal Don't conceal sensitive fields. --ssh-generate-key The type of SSH key to create: Ed25519 or RSA. For RSA, specify 2048, 3072, or 4096 (default) bits. Possible values: ed25519, rsa, rsa2048, rsa3072, rsa4096. (default Ed25519) --tags tags Set the tags to the specified (comma-separated) values. --template string Specify the filepath to read an item template from. --title title Set the item's title. --url URL Set the website where 1Password suggests and fills a Login, Password, or API Credential item. --vault vault Save the item in this vault. Default: Private. ``` Get a list of all item categories: ```shell theme={null} op item template list ``` Use assignment statements or an item category JSON template to save details in built-in or custom fields. [Learn more about creating items.](/cli/item-create/) [Learn more about item fields and fieldTypes.](/cli/item-fields/) #### Generate a password Use the `--generate-password` option to set a random password for a Login or Password item. The default is 32-characters, and includes upper and lowercase letters, numbers, and symbols (`!@.-_*`). You can specify the password length (between 1 and 64 characters) and the character types to use: ```shell theme={null} --generate-password='letters,digits,symbols,32' ``` #### Set additional fields with assignment statements You can use assignment statements as command arguments to set built-in and custom fields. ``` [

.][[]]= ``` Command arguments get logged in your command history, and can be visible to other processes on your machine. If you’re assigning sensitive values, use a JSON template instead. For example, to create a text field named "host" within a section named "Database Credentials", with the value set to 33.166.240.221: ```shell theme={null} DatabaseCredentials.host[text]=33.166.240.221 ``` The section name is optional unless multiple sections contain fields with the same name. Use a backslash to escape periods, equal signs, or backslashes in section or field names. Don’t use backslashes to escape the value. You can omit spaces in the section or field name, or refer to the field by its JSON short name (`name` or `n`). #### Create an item using a json template Use an item JSON template to assign sensitive values to an item. If you combine a template with assignment statements, assignment statements take precedence. 1. Save the appropriate item category template to a file: ```shell theme={null} op item template get --out-file login.json "Login" ``` 2. Edit the template. 3. Create a new item using the `-—template` flag to specify the path to the edited template: ```shell theme={null} op item create --template=login.json ``` 4. After 1Password CLI creates the item, delete the edited template. You can also create an item from standard input using an item JSON template. Pass the `-` character as the first argument, followed by any assignment statements. ```shell theme={null} op item template get Login | op item create --vault personal - ``` You can’t use both piping and the `--template` flag in the same command, to avoid collisions. ### Examples Create a Login item with a random password and website set using flags and custom and built-in fields set with assignment statements, including a one-time password field and a file attachment: ```shell theme={null} op item create --category=login --title='My Example Item' --vault='Test' \ --url https://www.acme.com/login \ --generate-password=20,letters,digits \ username=jane@acme.com \ 'Test Section 1.Test Field3[otp]=otpauth://totp/:?secret=&issuer=' \ 'FileName[file]=/path/to/your/file' ``` Create an item by duplicating an existing item from another vault and modifying it with assignment statements: ```shell theme={null} op item get "My Item" --format json | op item create --vault prod - \ username="My Username" password="My Password" ``` Duplicate all items in a vault in one account to a vault in another account: ```shell theme={null} op item list --vault test-vault --format json --account agilebits | \ op item get --format json --account agilebits - | \ op item create --account work - ``` ## item delete Delete or archive items you no longer need. ``` op item delete [{ | | | - }] [flags] ``` ### Flags ``` --archive Move the item to the Archive. --vault string Look for the item in this vault. ``` Deleted items remain available for 30 days in Recently Deleted. You can restore or permanently delete items from Recently Deleted in the 1Password apps. Use the `--archive` option to move an item to the Archive instead. Specify an item to delete or archive by its name, ID, or sharing link. #### Specify items on standard input The command treats each line of information on standard input (stdin) as an object specifier. Run `op help` to learn more about how to specify objects. The input can also be a list or array of JSON objects. The command will get an item for any object that has an ID. This is useful for passing information from one `op` command to another. ### Examples Delete an item: ``` op item delete "Defunct Login" ``` Move an item to the Archive: ``` op item delete "Defunct Login" --archive ``` ## item edit Edit an item's details. ``` op item edit { | | } [ ... ] [flags] ``` ### Flags ``` --dry-run Perform a dry run of the command and output a preview of the resulting item. --favorite Whether this item is a favorite item. Options: true, false. --generate-password[=recipe] Give the item a randomly generated password. --reveal Don't conceal sensitive fields. --tags tags Set the tags to the specified (comma-separated) values. An empty value will remove all tags. --template string Specify the filepath to read an item template from. --title title Set the item's title. --url URL Set the website where 1Password suggests and fills a Login, Password, or API Credential item. --vault vault Edit the item in this vault. ``` Specify the item by its name, ID, or sharing link. Use flags to update the title, tags, or generate a new random password. You can use assignment statements as command arguments to update built-in or custom fields. For sensitive values, use a template instead. #### Edit an item using assignment statements Caution: Command arguments can be visible to other processes on your machine. ```shell theme={null} [

.][[]]= ``` To create a new field or section, specify a field or section name that doesn’t already exist on the item. To edit an existing field, specify the current section and field name, then make changes to the fieldType or value. If you don’t specify a fieldType or value, it will stay the same. To delete a custom field, specify `[delete]` in place of the fieldType. If a section no longer has any fields, the section will also be deleted. You can't delete built-in fields, but you can set them to empty strings. Learn more about assignment statements: `op item create –-help`. [Learn more about available fields and fieldTypes.](/cli/item-fields) #### Edit an item using a template JSON item templates do not support passkeys. If you use a JSON template to update an item that contains a passkey, the passkey will be overwritten. To fix this, you can [restore a previous version of the item](https://support.1password.com/item-history/). You can use a JSON template to edit an item, alone or in combination with command arguments. Field assignment statements overwrite values in the template. 1. Get the item you want to edit in JSON format and save it to a file: ``` op item get oldLogin --format=json > updatedLogin.json ``` 2. Edit the file. 3. Use the `--template` flag to specify the path to the edited file and edit the item: op item edit oldLogin --template=updatedLogin.json 4. Delete the file. You can also edit an item using piped input: ```shell theme={null} cat updatedLogin.json | op item edit oldLogin ``` To avoid collisions, you can't combine piped input and the `--template` flag in the same command. ### Examples Add a 32-character random password that includes upper- and lower-case letters, numbers, and symbols to an item: ```shell theme={null} op item edit 'My Example Item' --generate-password='letters,digits,symbols,32' ``` Edit a custom field's value without changing the fieldType: ``` op item edit 'My Example Item' 'field1=new value' ``` Edit a custom field's fieldType without changing the value: ``` op item edit 'My Example Item' 'field1[password]' ``` Edit a custom field's type and value: ``` op item edit 'My Example Item' 'field1[monthyear]=2021/09' ``` Add a new custom field to an item: ``` op item edit 'My Example Item' 'section2.field5[phone]=1-234-567-8910' ``` Remove an existing custom field: ``` op item edit 'My Example Item' 'section2.field5[delete]' ``` Set the built-in username field to an empty value: ``` op item edit 'My Example Item' 'username=' ``` Edit an item using a template alongside command arguments and assignment statements: ```shell theme={null} op item edit oldLogin --vault Private 'username=Lucky' --template=updatedLogin.json ``` ## item get Get details about an item. Specify the item by its name, ID, or sharing link. ``` op item get [{ | | | - }] [flags] ``` ### Flags ``` --fields strings Return data from specific fields. Use `label=` to get the field by name or `type=` to filter fields by type. Specify multiple in a comma-separated list. --include-archive Include items in the Archive. Can also be set using OP_INCLUDE_ARCHIVE environment variable. --otp Output the primary one-time password for this item. --reveal Don't conceal sensitive fields. --share-link Get a shareable link for the item. --vault vault Look for the item in this vault. ``` If you have multiple items with the same name, or if you’re concerned about API rate limits, specify the item by its ID or limit the scope of the search with the `--vault` flag. [Learn more about IDs and caching.](/cli/reference) To retrieve the contents of a specific field, use `op read` instead. When using service accounts, you must specify a vault with the `--vault` flag or through piped input. #### Specify items on standard input `op item get` treats each line of information on standard input (stdin) as an object specifier. You can also input a list or array of JSON objects, and the command will get an item for any object that has an ID key. This is useful for passing information from one command to another. #### Items in the archive Items in the Archive are ignored by default. To get details for an item in the Archive, specify the item by ID or use the `--include-archive` option. ### Examples Get details for all items with a specified tag: ``` op item list --tags documentation --format json | op item get - ``` Get a CSV list of the username, and password for all logins in a vault: ``` op item list --categories Login --vault Staging --format json | op item get - --fields label=username,label=password ``` Get a JSON object of an item's username and password fields: ``` op item get Netflix --fields label=username,label=password --format json ``` Get a list of fields by type: ``` op item get Netflix --fields type=concealed ``` Get an item's one-time password: ``` op item get Google --otp ``` Retrieve a shareable link for the item referenced by ID: ``` op item get kiramv6tpjijkuci7fig4lndta --vault "Ops Secrets" --share-link ``` ## item list List items. ``` op item list [flags] ``` ### Flags ``` --categories categories Only list items in these categories (comma-separated). --favorite Only list favorite items. --include-archive Include items in the Archive. Can also be set using OP_INCLUDE_ARCHIVE environment variable. --long Output a more detailed item list. --tags tags Only list items with these tags (comma-separated). --vault vault Only list items in this vault. ``` Returns a list of all items the account has read access to by default. Use flags to filter results. Excludes items in the Archive by default. Categories are: * API Credential * Bank Account * Credit Card * Database * Document * Driver License * Email Account * Identity * Login * Membership * Outdoor License * Passport * Password * Reward Program * Secure Note * Server * Social Security Number * Software License * Wireless Router ### Examples Get details for all items with a specified tag: ``` op item list --tags documentation --format=json | op item get - ``` Get a CSV list of the username, and password for all logins in a vault: ``` op item list --categories Login --vault Staging --format=json | op item get - --fields username,password ``` Selecting a tag `` will also return items with tags sub-nested to ``. For example: ``. ## item move Move an item between vaults. Moving an item creates a copy of the item in the destination vault and deletes the item from the current vault. As a result, the item gets a new ID. ``` op item move [{ | | | - }] [flags] ``` ### Flags ``` --current-vault string Vault where the item is currently saved. --destination-vault string The vault you want to move the item to. --reveal Don't conceal sensitive fields. ``` To restore or permanently delete the original item, find the item in Recently Deleted in your 1Password app or on 1Password.com. Moving an item between vaults may change who has access to the item. ### Examples Move an item from the Private vault to the Shared vault: ``` op item move "My Example Item" --current-vault Private --destination-vault Shared ``` ## item share Share an item. ``` op item share { | } [flags] ``` ### Flags ``` --emails strings Email addresses to share with. --expires-in duration Expire link after the duration specified in (s)econds, (m)inutes, (h)ours, (d)ays, and/or (w)eeks. (default 7d) --vault string Look for the item in this vault. --view-once Expire link after a single view. ``` You can securely share copies of passwords and other items you've saved in 1Password with anyone, even if they don't use 1Password. When you share an item, you'll get a unique link that you can send to others. Copy the URL, then send the link to the person or people you want to share the item copy with, like in an email or text message. Anyone with the link can view the item copy unless you specify addresses with the emails flag. If you edit an item, your changes won't be shared until you share the item again. Note that file attachments and Document items cannot be shared. ## item template ### Subcommands * [item template get](#item-template-get): Get an item template * [item template list](#item-template-list): Get a list of templates ## item template get Return a template for an item type. ``` op item template get [{ | - }] [flags] ``` ### Flags ``` --file-mode filemode Set filemode for the output file. It is ignored without the --out-file flag. (default 0600) -f, --force Do not prompt for confirmation. -o, --out-file string Write the template to a file instead of stdout. ``` You can create a new item with a template. Run `op item create --help` for more information. Categories are: * API Credential * Bank Account * Credit Card * Database * Document * Driver License * Email Account * Identity * Login * Membership * Outdoor License * Passport * Password * Reward Program * Secure Note * Server * Social Security Number * Software License * Wireless Router ## item template list Lists available item type templates. ``` op item template list [flags] ``` Use `op item template get ` to get a template. # plugin Source: https://www.1password.dev/cli/reference/management-commands/plugin Manage your shell plugin configurations. You can use shell plugins to securely authenticate third-party CLIs with 1Password, rather than storing your CLI credentials in plaintext. After you configure a plugin, 1Password CLI will prompt you to authenticate the third-party CLI with your fingerprint or other system authentication option. [Learn more about shell plugins.](/cli/shell-plugins) ### Subcommands * [plugin clear](#plugin-clear): Clear shell plugin configuration * [plugin init](#plugin-init): Configure a shell plugin * [plugin inspect](#plugin-inspect): Inspect your existing shell plugin configurations * [plugin list](#plugin-list): List all available shell plugins * [plugin run](#plugin-run): Provision credentials from 1Password and run this command ## plugin clear Clear an existing shell plugin configuration. ```shell theme={null} op plugin clear [flags] ``` ### Flags ``` --all Clear all configurations for this plugin that apply to this directory and/or terminal session, including the global default. -f, --force Apply immediately without asking for confirmation. ``` You can clear one configuration at a time, in this order of precedence: * Terminal session default * Directory default, from the current directory to `$HOME` * Global default For example, if you're in the directory `$HOME/projects/awesomeProject` and you have a terminal session default, directory defaults for `$HOME` and `$HOME/projects/awesomeProject`, and a global default credential configured, you would need to run `op plugin clear aws` four times to clear all of your defaults. To clear your global default credentials, terminal session default, and the defaults for your current directory at the same time, run `op plugin clear aws --all`. ## plugin init Choose a shell plugin to install and configure your default credentials. Bash, Zsh, and fish shells are supported. ```shell theme={null} op plugin init [ ] [flags] ``` Shell plugins require the [1Password desktop app integration](/cli/shell-plugins/). To see all available plugins, run `op plugin list`. #### Configure your default credentials 1Password CLI prompts you to select or import the credentials you want to use with the third-party CLI, then returns a command to source your `plugins.sh` file and make the plugin alias usable. To use the plugin beyond the current terminal session, make sure to add the source command to your RC file or shell profile (e.g. `~/.bashrc`, `~/.zshrc`, `~/.config/fish/config.fish`). For example: ```shell theme={null} echo "source ~/.config/op/plugins.sh" >> ~/.bashrc && source ~/.bashrc ``` #### Configuration options You can choose whether 1Password CLI remembers your configuration. With any option, your credentials never leave your 1Password account. * "Prompt me for each new terminal session" only configures the credentials for the current terminal session. Once you exit the terminal, your default is removed. * "Use automatically when in this directory or subdirectories" makes your credentials the default in the current directory and all its subdirectories, as long as no other directory-specific defaults are set in them. A terminal-session default takes precedence over a directory-specific one. * "Use as global default on my system" sets the credentials as the default in all terminal sessions and directories. A directory-specific default takes precedence over a global one. ## plugin inspect Inspect your existing shell plugin configurations. ```shell theme={null} op plugin inspect [ ] [flags] ``` You can run `op plugin inspect` to select a plugin from the list of all available plugins, or `op plugin inspect ` to inspect a specific plugin. 1Password CLI returns a list of the credentials you've configured to use with the plugin and their default scopes, as well as configured alias details. ## plugin list Lists all available shell plugins, their usage, name, and required fields. ```shell theme={null} op plugin list [flags] ``` To get started with a shell plugin, run `op plugin init `. ## plugin run Provision credentials from 1Password and run this command. ```shell theme={null} op plugin run ... [flags] ``` `op plugin run` passes your credentials saved in 1Password to the underlying CLI and runs the provided command. If you haven't configured your default credentials, 1Password CLI will prompt you to select an item that contains your credentials. After this, you will be automagically authenticated with this CLI, and your selection will be recorded for future calls to this plugin in the current terminal session. To configure a default credential, see `op plugin init --help`. # service-account Source: https://www.1password.dev/cli/reference/management-commands/service-account Manage service accounts. ### Subcommands * [service-account create](#service-account-create): Create a service account * [service-account ratelimit](#service-account-ratelimit): Retrieve rate limit usage for a service account ## service-account create Create a service account to gain programmatic access to your secrets using 1Password CLI. ```shell theme={null} op service-account create [flags] ``` ### Flags ``` --can-create-vaults Allow the service account to create new vaults. --expires-in duration Set how long the service account is valid for in (s)econds, (m)inutes, (h)ours, (d)ays, or (w)eeks. --raw Only return the service account token. --vault stringArray Give access to this vault with a set of permissions. Has syntax :[,] ``` You can specify the vaults the service account can access, as well as the permissions it will have for each vault using the `--vault` flag. The syntax looks like this: ```shell theme={null} --vault :, ``` The permissions can be one of the following: * `read_items` * `write_items` (requires `read_items`) * `share_items` (requires `read_items`) If no permissions are specified, it will default to `read_items`. You can set an expiry to a service account using the `--expires-in` flag. 1Password CLI only returns the service account token once. Save the token in 1Password immediately to avoid losing it. Treat this token like a password, and don't store it in plaintext. You can't grant a service account access to your built-in [Personal](https://support.1password.com/1password-glossary/#personal-vault), [Private](https://support.1password.com/1password-glossary/#private-vault), or [Employee](https://support.1password.com/1password-glossary/#employee-vault) vault. ### Examples Create a new service account: ```shell theme={null} op service-account create my-service-account --vault Dev:read_items --vault Test:read_items,write_items ``` Create a service account with an expiry: ```shell theme={null} op service-account create my-service-account --expires-in=24h ``` Create a service account that can create new vaults: ```shell theme={null} op service-account create my-service-account --can-create-vaults ``` ## service-account ratelimit Retrieve hourly and daily rate limit usage for a service account. ```shell theme={null} op service-account ratelimit [{ | }] [flags] ``` # user Source: https://www.1password.dev/cli/reference/management-commands/user ### Subcommands * [user confirm](#user-confirm): Confirm a user * [user delete](#user-delete): Remove a user and all their data from the account * [user edit](#user-edit): Edit a user's name or Travel Mode status * [user get](#user-get): Get details about a user * [user list](#user-list): List users * [user provision](#user-provision): Provision a user in the authenticated account * [user reactivate](#user-reactivate): Reactivate a suspended user * [user recovery](#user-recovery): Manage user recovery in your 1Password account * [user suspend](#user-suspend): Suspend a user ## user confirm Specify the user by their e-mail address, name, or ID. ```shell theme={null} op user confirm [{ | | | - }] [flags] ``` ### Flags ``` --all Confirm all unconfirmed users. ``` Specify the user by their e-mail address, name, or ID. ### Examples Confirm a user by specifying their name: ```shell theme={null} op user confirm "Wendy Appleseed" ``` Confirm a user by specifying their email: ```shell theme={null} op user confirm "wendy.appleseed@example.com" ``` ## user delete Remove a user and all their data from the account. ```shell theme={null} op user delete [{ | | | - }] [flags] ``` Specify the user by their e-mail address, name, or ID. ## user edit Change a user's name or Travel Mode status. ```shell theme={null} op user edit [{ | | | - }] [flags] ``` ### Flags ``` --name string Set the user's name. --travel-mode on|off Turn Travel Mode on or off for the user. (default off) ``` Specify the user by their e-mail address, name, or ID. ## user get Get details about a user. ```shell theme={null} op user get [{ | | | --me | - }] [flags] ``` ### Flags ``` --fingerprint Get the user's public key fingerprint. --me Get the authenticated user's details. --public-key Get the user's public key. ``` Specify the user by their e-mail address, name, or ID. #### Use standard input to specify objects If you enter a hyphen (`-`) instead of a single object for this command, the tool will read object specifiers from standard input (stdin). Separate each specifier with a new line. For more information about how to specify objects, run `op help`. You can also pass the command a list or array of JSON objects. The tool will get an item for any object that has an ID, ignoring line breaks. This is useful for passing information from one `op` command to another. ### Examples Look up a user by name: ```shell theme={null} op user get "Wendy Appleseed" ``` Look up a user by e-mail: ```shell theme={null} op user get wendy.appleseed@example.com ``` Get details for all users: ```shell theme={null} op user list --format=json | op user get - ``` Get the public key for all users in a group: ```shell theme={null} op user list --group "Frontend Developers" --format=json | op user get - --publickey ``` Get details for all users who have access to a vault: ```shell theme={null} op user list --vault Staging --format=json | op user get - ``` ## user list List users. ```shell theme={null} op user list [flags] ``` ### Flags ``` --group group List users who belong to a group. --vault vault List users who have direct access to vault. ``` Returns all users in an account by default. Use flags to filter results. When you use the `--group` option, the output includes the user's role in the group. ### Examples Get details for all users: ```shell theme={null} op user list --format=json | op user get - ``` Get the public key for all users in a group: ```shell theme={null} op user list --group "Frontend Developers" --format=json | op user get - --publickey ``` Get details for all users who have access to a vault: ```shell theme={null} op user list --vault Staging --format=json | op user get - ``` ## user provision Provision a user in the authenticated account. ```shell theme={null} op user provision [flags] ``` ### Flags ``` --email string Provide the user's email address. --language string Provide the user's account language. (default "en") --name string Provide the user's name. ``` Provisioned users will receive an invitation email to join the 1Password account. Once a user accepts an invitation, an admin must confirm them on 1Password.com or using the `op user confirm` command. Invited users will not be considered for billing until they accept their invitation. ### Examples Invite a user by specifying their e-mail address and name: ```shell theme={null} op user provision --name "Wendy Appleseed" --email "wendy.appleseed@example.com" ``` ## user reactivate Reactivate a suspended user. ```shell theme={null} op user reactivate [{ | | | - }] [flags] ``` A user may be specified by their e-mail address, name, or ID. ## user recovery ### Subcommands * [user recovery begin](#user-recovery-begin): Begin recovery for users in your 1Password account ## user recovery begin Begin recovery for users in your 1Password account: ```shell theme={null} op user recovery begin [ { | | } ] [flags] ``` ### Examples Begin recovery for multiple users by UUID: ```shell theme={null} op user recovery begin ZMAE4RTRONHN7LGELNYYO373KM WHPOFIMMYFFITBVTOTZUR3R324 ``` ## user suspend Suspend a user. ```shell theme={null} op user suspend [{ | | | - }] [flags] ``` ### Flags ``` --deauthorize-devices-after duration Deauthorize the user's devices after a time (rounded down to seconds). ``` Specify the user by their e-mail address, name, or ID. A suspended user will immediately be logged out of all devices and will not be able to log in or access any data. Users in a suspended state are not considered in billing. You can reactivate a suspended user with the `op user reactivate` command. # vault Source: https://www.1password.dev/cli/reference/management-commands/vault Manage permissions and perform CRUD operations on your 1Password vaults. ### Subcommands * [vault create](#vault-create): Create a new vault * [vault delete](#vault-delete): Remove a vault * [vault edit](#vault-edit): Edit a vault's name, description, icon, or Travel Mode status * [vault get](#vault-get): Get details about a vault * [vault group](#vault-group): Manage group vault access * [vault list](#vault-list): List all vaults in the account * [vault user](#vault-user): Manage user vault access ## vault create Create a new vault ``` op vault create [flags] ``` ### Flags ``` --allow-admins-to-manage true|false Set whether administrators can manage the vault. If not provided, the default policy for the account applies. --description description Set the vault's description. --icon string Set the vault icon. ``` Valid icon keywords are: airplane, application, art-supplies, bankers-box, brown-briefcase, brown-gate, buildings, cabin, castle, circle-of-dots, coffee, color-wheel, curtained-window, document, doughnut, fence, galaxy, gears, globe, green-backpack, green-gem, handshake, heart-with-monitor, house, id-card, jet, large-ship, luggage, plant, porthole, puzzle, rainbow, record, round-door, sandals, scales, screwdriver, shop, tall-window, treasure-chest, vault-door, vehicle, wallet, wrench ## vault delete Remove a vault. Specify the vault to delete by name or ID. ``` op vault delete [{ | | - }] [flags] ``` A vault may be specified by name or ID. ## vault edit Edit a vault's name, description, icon, or Travel Mode status. Specify the vault by name or ID. ``` op vault edit [{ | | - }] [flags] ``` ### Flags ``` --description description Change the vault's description. --icon icon Change the vault's icon. --name name Change the vault's name. --travel-mode on|off Turn Travel Mode on or off for the vault. (default off) ``` A vault may be specified by name or ID. Set Travel Mode to on to mark a vault as safe for travel. Vaults with Travel Mode set to off are hidden in the 1Password apps and browser extension when Travel Mode is enabled for a user. Valid icon keywords are: airplane, application, art-supplies, bankers-box, brown-briefcase, brown-gate, buildings, cabin, castle, circle-of-dots, coffee, color-wheel, curtained-window, document, doughnut, fence, galaxy, gears, globe, green-backpack, green-gem, handshake, heart-with-monitor, house, id-card, jet, large-ship, luggage, plant, porthole, puzzle, rainbow, record, round-door, sandals, scales, screwdriver, shop, tall-window, treasure-chest, vault-door, vehicle, wallet, wrench ## vault get Get details about a vault. Specify the vault by name or ID. ``` op vault get [{ | | - }] [flags] ``` A vault may be specified by name or ID. #### Use standard input to specify objects If you enter a hyphen (`-`) instead of a single object for this command, the tool will read object specifiers from standard input (stdin). Separate each specifier with a new line. For more information about how to specify objects, run `op help`. You can also pass the command a list or array of JSON objects. The tool will get an item for any object that has an ID, ignoring line breaks. This is useful for passing information from one `op` command to another. ### Examples Get details for all vaults: ``` op vault list --format=json | op vault get - ``` Get details for the vaults that a group has access to: ``` op vault list --group security --format=json | op vault get - ``` ## vault group ### Subcommands * [vault group grant](#vault-group-grant): Grant a group permissions to a vault * [vault group list](#vault-group-list): List all the groups that have access to the given vault * [vault group revoke](#vault-group-revoke): Revoke a portion or the entire access of a group to a vault ## vault group grant Grant a group permissions in a vault. ``` op vault group grant [flags] ``` ### Flags ``` --group group The group to receive access. --no-input input Do not prompt for input on interactive terminal. --permissions permissions The permissions to grant to the group. --vault vault The vault to grant group permissions to. ``` Permissions are specified in a comma separated list such as: ``` view_items,view_and_copy_passwords,edit_items ``` 1Password Teams includes three permissions: ``` allow_viewing, allow_editing, allow_managing ``` 1Password Business includes the permissions above as well as more granular options: allow\_viewing ``` view_items, view_and_copy_passwords, view_item_history ``` allow\_editing ``` create_items, edit_items, archive_items, delete_items, import_items, export_items, copy_and_share_items, print_items ``` allow\_managing ``` manage_vault ``` When granting or revoking permissions, some permissions require dependent permissions to be granted or revoked alongside them. [Learn more about managing vault permissions.](/cli/vault-permissions/) ### Examples Grant a group certain permissions in a vault with a business account: ``` op vault group grant --vault VAULT --group GROUP \ --permissions view_items,create_items,allow_viewing ``` ``` op vault group grant --vault VAULT --group GROUP \ --permissions allow_viewing,export_items ``` Grant a group certain permissions in a vault with a team account: ``` op vault group grant --vault VAULT --group GROUP \ --permissions allow_viewing,allow_editing ``` ## vault group list List all the groups that have access to the given vault. ``` op vault group list [{ | - }] [flags] ``` ## vault group revoke Revoke a group's permissions in a vault, in part or in full. ``` op vault group revoke [flags] ``` ### Flags ``` --group group The group to revoke access from. --no-input input Do not prompt for input on interactive terminal. --permissions permissions The permissions to revoke from the group. --vault vault The vault to revoke access to. ``` Not specifying any permissions revokes the group's access to the vault. Removing all existing permissions also revokes the group’s access to the vault. Permissions are specified in a comma separated list such as: ``` view_items,view_and_copy_passwords,edit_items ``` 1Password Teams includes three permissions: ``` allow_viewing, allow_editing, allow_managing ``` 1Password Business includes the permissions above as well as more granular options: allow\_viewing ``` view_items, view_and_copy_passwords, view_item_history ``` allow\_editing ``` create_items, edit_items, archive_items, delete_items, import_items, export_items, copy_and_share_items, print_items ``` allow\_managing ``` manage_vault ``` When granting or revoking permissions, some permissions require dependent permissions to be granted or revoked alongside them. [Learn more about managing vault permissions.](/cli/vault-permissions/) ### Examples Remove a group from a vault: ``` op vault group revoke --vault VAULT --group GROUP ``` Revoke certain permissions from a group in a vault with a business account: ``` op vault group revoke --vault VAULT --group GROUP \ --permissions view_items,create_items,allow_editing ``` Revoke certain permissions from a group in a vault with a team account: ``` op vault group revoke --vault VAULT --group GROUP \ --permissions allow_viewing,allow_editing ``` ## vault list List vaults. ``` op vault list [flags] ``` ### Flags ``` --group string List vaults a group has access to. --permission permissions List only vaults that the specified user/group has this permission for. --user string List vaults that a given user has access to. ``` By default, returns all vaults the current user has read access to. ### Examples Get details for all vaults: ``` op vault list --format=json | op vault get - ``` Get details for vaults that a group has access to: ``` op vault list --group Security --format=json | op vault get - ``` Get details for vaults that a user has access to: ``` op vault list --user wendy_appleseed@1password.com --format=json | op vault get - ``` Only list vaults for which the user/group has a specific set of permissions: ``` op vault list --user wendy_appleseed@1password.com --permission manage_vault ``` ## vault user ### Subcommands * [vault user grant](#vault-user-grant): Grant a user access to a vault * [vault user list](#vault-user-list): List all users with access to the vault and their permissions * [vault user revoke](#vault-user-revoke): Revoke a portion or the entire access of a user to a vault ## vault user grant Grant a user permissions in a vault. ``` op vault user grant [flags] ``` ### Flags ``` --no-input input Do not prompt for input on interactive terminal. --permissions permissions The permissions to grant to the user. --user user The user to receive access. --vault vault The vault to grant access to. ``` Permissions are specified in a comma separated list such as: ``` view_items,view_and_copy_passwords,edit_items ``` 1Password Teams and 1Password Families include three permissions: ``` allow_viewing, allow_editing, allow_managing ``` 1Password Business includes the permissions above as well as more granular options: allow\_viewing ``` view_items, view_and_copy_passwords, view_item_history ``` allow\_editing ``` create_items, edit_items, archive_items, delete_items, import_items, export_items, copy_and_share_items, print_items ``` allow\_managing ``` manage_vault ``` When granting or revoking permissions, some permissions require dependent permissions to be granted or revoked alongside them. [Learn more about managing vault permissions.](/cli/vault-permissions/) ### Examples Grant a user certain permissions in a vault with a business account: ``` op vault user grant --vault VAULT --user USER \ --permissions view_items,create_items,allow_viewing ``` ``` op vault user grant --vault VAULT --user USER \ --permissions allow_viewing,export_items ``` Grant a user certain permissions in a vault with a team account: ``` op vault user grant --vault VAULT --user USER \ --permissions allow_viewing,allow_editing ``` ## vault user list List all users with access to the vault and their permissions. ``` op vault user list [flags] ``` ## vault user revoke Revoke a user's permissions in a vault, in part or in full. ``` op vault user revoke [flags] ``` ### Flags ``` --no-input input Do not prompt for input on interactive terminal. --permissions permissions The permissions to revoke from the user. --user user The user to revoke access from. --vault vault The vault to revoke access to. ``` Not specifying any permissions revokes the user's access to the vault. Removing all existing permissions also revokes the user’s access to the vault. Permissions are specified in a comma separated list such as: ``` view_items,view_and_copy_passwords,edit_items ``` 1Password Teams and 1Password Families include three permissions: ``` allow_viewing, allow_editing, allow_managing ``` 1Password Business includes the permissions above as well as more granular options: allow\_viewing ``` view_items, view_and_copy_passwords, view_item_history ``` allow\_editing ``` create_items, edit_items, archive_items, delete_items, import_items, export_items, copy_and_share_items, print_items ``` allow\_managing ``` manage_vault ``` When granting or revoking permissions, some permissions require dependent permissions to be granted or revoked alongside them. [Learn more about managing vault permissions.](/cli/vault-permissions/) ### Examples Remove a user from a vault: ``` op vault user revoke --vault VAULT --user USER ``` Revoke certain permissions from a user in a vault with a business account: ``` op vault user revoke --vault VAULT --user USER \ --permissions view_items,create_items,allow_editing ``` Revoke certain permissions from a user in a vault with a team account: ``` op vault user revoke --vault VAULT --user USER \ --permissions allow_viewing,allow_editing ``` # Update to the latest version of 1Password CLI Source: https://www.1password.dev/cli/reference/update To make sure you're up to date with the latest features and security improvements, always use the latest version of 1Password CLI. To check what version you currently have installed, use `op --version`. ## Download the latest version There are two ways you can download the latest version for your platform and architecture: * Visit our [release page](https://app-updates.agilebits.com/product_history/CLI2) and download the latest version of 1Password CLI. * Use `op update` to download the latest version from the command line. Set the `--directory` flag to choose where to download the installer (defaults to `~/Downloads`) and confirm the download. You can use `op update` without signing in. After downloading the appropriate installer, follow the [installation instructions](/cli/get-started/#step-1-install-1password-cli) to finish the update. ## Update with a package manager If you installed 1Password CLI with a package manager, use the following commands to update your installation. ```shell title="Brew" theme={null} brew upgrade --cask 1password-cli ``` # Release notes Source: https://www.1password.dev/cli/release-notes # Example scripts Source: https://www.1password.dev/cli/scripts The 1Password Solutions team manages [a repository of example 1Password CLI scripts](https://github.com/1Password/solutions) that you can use as inspiration for your own projects. You'll need to install [jq](https://stedolan.github.io/jq/), a command-line JSON processor, for the example scripts to work correctly. You can find demo scripts to help you: * [Migrate from another password solution](https://github.com/1Password/solutions/tree/main/1password/migration) * [Provision new users from a CSV](https://github.com/1Password/solutions/tree/main/1password/scripted-provisioning) * [Audit or manage existing users](https://github.com/1Password/solutions/tree/main/1password/user-management) * [Manage your vaults and groups](https://github.com/1Password/solutions/tree/main/1password/account-management) * [Create, update, and share items](https://github.com/1Password/solutions/tree/main/1password/item-management) Follow the build integrations workflow guide to choose the right authentication method and configuration for your use case. ## Learn more * [Get started with secret references](/cli/secret-references/) * [Load secrets into scripts](/cli/secrets-scripts/) * [Load secrets into the environment](/cli/secrets-environment-variables/) * [Load secrets into config files](/cli/secrets-config-files/) * [Workflow: Secure your developer secrets](/get-started/secure-developer-secrets) * [Developer quickstart](/get-started/developer-quickstart) # Secret reference syntax Source: https://www.1password.dev/cli/secret-reference-syntax An environment file using a plaintext secret and the same file using a secret reference.

An environment file using a plaintext secret and the same file using a secret reference.

Secret reference URIs point to where a secret is saved in your 1Password account using the names (or [unique identifiers](/cli/reference/#unique-identifiers-ids)) of the vault, item, section, and field where the information is stored. ```shell theme={null} op:////[section-name/] ``` Secret references remove the risk of exposing plaintext secrets in your code and reflect changes you make in your 1Password account, so when you run a script you get the latest value. You can use secret references with:

Load secrets into environment variables, configuration files, and scripts.

Programmatically access your secrets with Go, JavaScript, and Python.

Use secret references to secure your secrets management workflows.

Create, preview, and read secret references in your code.

Securely access your secrets in Kubernetes, CircleCI, GitHub Actions, Jenkins, Terraform, Pulumi, Postman, and more.

## Get secret references ### With the 1Password desktop app

To see the option to copy secret references in the 1Password desktop app, first turn on the [integration with 1Password CLI](/cli/app-integration). Then: 1. Open the item where the secret you want to reference is stored. 2. Select next to the field that contains the secret you want to reference, then select Copy Secret Reference.

An item in 1Password with the Copy Secret Reference option selected.

### With 1Password for VS Code You can use 1Password for VS Code to [insert secret references](/vscode/#get-values) from 1Password as you edit your code. First, [install the extension](/vscode/). Then: 1. Open the **[Command Palette ](https://code.visualstudio.com/api/ux-guidelines/command-palette)**. 2. Enter `1Password: Get from 1Password`. 3. Enter the item name or ID. 4. Select the field to use. ### With 1Password CLI To get a secret reference with 1Password CLI, run [`op item get`](/cli/reference/management-commands/item/#item-get) with the `--format json` flag and include the `--fields` flag to specify a field label. Then use [jq ](https://jqlang.github.io/jq/) to retrieve the secret reference from the JSON output. For example: ```shell theme={null} op item get GitHub --format json --fields username | jq .reference #code-result "op://development/GitHub/username" ``` To get secret references for every field on an item, use [`op item get`](/cli/reference/management-commands/item/#item-get) with the `--format json` flag without specifying a field. ```shell theme={null} op item get GitHub --format json ``` Each field object will include a `reference` key that contains its secret reference. For the example `GitHub` item, the output looks like this: ```json highlight={8,17,29,40} theme={null} "fields": [ { "id": "username", "type": "STRING", "purpose": "USERNAME", "label": "username", "value": "wendy_appleseed@agilebits.com", "reference": "op://development/GitHub/username" }, { "id": "password", "type": "CONCEALED", "purpose": "PASSWORD", "label": "password", "value": "GADbhK6MjNZrRftGMqto", "entropy": 115.5291519165039, "reference": "op://development/GitHub/password", "password_details": { "entropy": 115, "generated": true, "strength": "FANTASTIC" } }, { "id": "notesPlain", "type": "STRING", "purpose": "NOTES", "label": "notesPlain", "reference": "op://development/GitHub/notesPlain" }, { "id": "5ni6bw735myujqe4elwbzuf2ee", "section": { "id": "hv46kvrohfj75q6g45km2uultq", "label": "credentials" }, "type": "CONCEALED", "label": "personal_token", "value": "ghp_WzgPAEutsFRZH9uxWYtw", "reference": "op://development/GitHub/credentials/personal_token" } ] } ``` ## Syntax rules ### Supported characters Secret references are case-insensitive and support the following characters: * alphanumeric characters (`a-z`, `A-Z`, `0-9`) * `-`, `_`, `.` and the whitespace character If a secret reference includes a whitespace, enclose the secret reference in quotation marks. For example: ```shell theme={null} op read "op://development/aws/Access Keys/access_key_id" ``` Any part of a secret reference that includes an unsupported character must be referred to by its [unique identifier (ID)](/cli/reference/#unique-identifiers-ids) instead of its name. To get an ID, run [`op item get`](/cli/reference/management-commands/item#item-get) with the output set to JSON. For example, to get the ID for a custom text field named `test/`: ``` op item get PagerDuty --fields label=test/ --format json #code-result { "id": "hu4vwo3bjkawq2uw2fkn5pkjzu", "section": { "id": "add more" }, "type": "STRING", "label": "text/", "value": "t", "reference": "op://Management/PagerDuty/add more/hu4vwo3bjkawq2uw2fkn5pkjzu" } ``` ### File attachments To reference a file attachment, use the file name in place of a field name: ```shell theme={null} op://vault-name/item-name/[section-name/]file-name ``` ### Externally-set variables If you use different sets of secrets in different environments, you can include variables within secret references and then set the variable to switch between secrets. For example, the `APP_ENV` variable in the example below can be set to `dev` to load development credentials or `prod` to load production credentials, assuming the credentials are stored in 1Password vaults named `dev` and `prod`. ```shell app.env theme={null} MYSQL_DATABASE = "op://$APP_ENV/mysql/database" MYSQL_USERNAME = "op://$APP_ENV/mysql/username" MYSQL_PASSWORD = "op://$APP_ENV/mysql/password" ``` Learn how to use variables to switch between sets of secrets in [environment files](/cli/secrets-environment-variables#optional-differentiate-between-environments) and [config files](/cli/secrets-config-files#step-3-differentiate-between-environments). ### Field and file metadata attributes You can use secret references with query parameters to get more information about an item. #### Attribute parameter To get information about item fields and file attachments, use the `attribute` (or `attr`) query parameter. ```html Fields theme={null} op:///[/

]/?attribute= ``` ```html File attachments theme={null} op:///[/

]/?attribute= ```

Field attributes: | Attribute | Definition | | --------- | ------------------------------------------------------------------------------- | | `type` | The field's type | | `value` | The field's content | | `id` | The field's unique identifier | | `purpose` | The designation of a built-in field (can be "username", "password", or "notes") | | `otp` | Use with one-time password fields to generate a one-time password code |

File attachment attributes: | Attribute | Definition | | --------- | --------------------------------------- | | `type` | The field's type | | `content` | The file attachment's content | | `size` | The size of the file attachment | | `id` | The file attachment's unique identifier | | `name` | The name of the file attachment |

For example, to retrieve an item's one-time password code: ```shell theme={null} op read "op://development/GitHub/Security/one-time password?attribute=otp" #code-result 359836 ``` To retrieve a field's type: ```shell theme={null} op read "op://Personal/aws/access credentials/username?attribute=type" #code-result string ``` To retrieve the name of a file attachment: ```shell theme={null} op read "op://app-infra/ssh/key.pem?attribute=name" #code-result key.pem ``` #### SSH format parameter To get an SSH private key in the OpenSSH format, include the `ssh-format` query parameter with the value `openssh` on a secret reference for the SSH key's `private key` field. ```shell theme={null} op read "op://Private/ssh keys/ssh key/private key?ssh-format=openssh" #code-result -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABD3rRrf8J ruD0CxZTYfpbTYAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIJ5B/GnxX6t9jMwQ G7QE7r5daJLkMKTZhNZhWfvzK2y+AAAAkLgQAivYu/+12/YrZhK5keIAZf4ZgsZsZ2JI2q qbx23PqgO93oGy1iCxXe3kngQL4cM6lwOZPsZPKCinkN6KxEr6RnXqFRHJbMpOiGeZhTuD rjeo77HqFdxDqDeckB77XCKL0Ew28H5JlM/WO31XR3Z4VBAgTe+BQLjrFV8WU5UX38hpBJ PMJyRsK72ZUDDaGQ== -----END OPENSSH PRIVATE KEY----- ``` ## Secret reference examples ### A field inside a section To create a secret reference that refers to the PagerDuty email field, which is within the Admin section, use: ```shell theme={null} op://Management/PagerDuty/Admin/email ```

* `Management` refers to the vault where the item is saved * `PagerDuty` refers to the item * `Admin` refers to the section where the field is a part of * `email` refers to the field where the secret you want to reference is located

### A field without a section To create a secret reference for the Stripe publishable-key field, which is not part of a section, use: ```shell theme={null} op://dev/Stripe/publishable-key ```

* `dev` refers to the vault where the item is saved * `Stripe` refers to the item * `publishable-key` refers to the field where the secret you want to reference is located

## Learn more * [Use secret references with 1Password CLI](/cli/secret-references/) * [Get started with 1Password SDKs](/sdks/) * [Load secrets into config files](/cli/secrets-config-files/) * [Load secrets into the environment](/cli/secrets-environment-variables/) * [Template syntax](/cli/secrets-template-syntax/) * [Workflow: Secure your developer secrets](/get-started/secure-developer-secrets) # Use secret references with 1Password CLI Source: https://www.1password.dev/cli/secret-references **New beta feature** You can now [pass secrets as environment variables](/cli/secrets-environment-variables) to applications or scripts from [1Password Environments](/environments). This allows you to more easily access project secrets from 1Password without the need to create secret references. With 1Password CLI, you can use [secret references](/cli/secret-reference-syntax) to securely load information saved in 1Password into environment variables, configuration files, and scripts without exposing any secrets in plaintext. A secret reference URI includes the names (or [unique identifiers](/cli/reference/#unique-identifiers-ids)) of the vault, item, section, and field where a secret is stored in your 1Password account: ```shell theme={null} op:////[section-name/] ``` To replace secret references with the secrets they refer to at runtime, use [`op read`](#with-op-read), [`op run`](#with-op-run), or [`op inject`](#with-op-inject). We recommend using [1Password Service Accounts](/service-accounts/) to follow the [principle of least privilege](/cli/best-practices/). Service accounts support restricting 1Password CLI to specific vaults, so that processes in your authorized terminal session can only access items required for a given purpose. ## Requirements Before you can use secret references to securely load your secrets with 1Password CLI, you'll need to: 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. [Install 1Password CLI.](/cli/get-started/#step-1-install-1password-cli) 3. Save the secrets you want to reference in your 1Password account. ## Step 1: Get secret references You can get secret references in several ways: * [With the 1Password desktop app](/cli/secret-reference-syntax/#with-the-1password-desktop-app): Copy secret references from the app. * [With 1Password for VS Code](/vscode/#get-values): Insert secret references from 1Password as you edit code. * [With 1Password CLI](/cli/secret-reference-syntax/#with-1password-cli): Get secret references for one or multiple fields with `op item get`. * [With the secret reference syntax](/cli/secret-reference-syntax/#syntax-rules): Write secret references manually. ## Step 2: Replace plaintext secrets with secret references After you create secret references, use them in place of plaintext secrets in your code. The example below shows a GitHub environment file with a secret reference pointing to where the GitHub Personal Access Token is stored in 1Password rather than a plaintext token. An environment file using a plaintext secret and the same file using a secret reference.

## Step 3: Resolve secret references There are three ways you can replace secret references with the actual secrets they reference at runtime: * [Use `op read` to write secrets to `stdout` or to a file.](#with-op-read) * [Use `op run` to pass secrets as environment variables to a process.](#with-op-run) * [Use `op inject` to inject secrets into configuration files or scripts.](#with-op-inject) ### With `op read` You can use [`op read`](/cli/reference/commands/read/) with a secret reference to print the secret to `stdout`. ```shell theme={null} op read op://development/GitHub/credentials/personal_token #code-result ghp_WzgPAEutsFRZH9uxWYtw ``` To write the secret to a file instead of `stdout`, include the `--out-file` flag (or `-o`) with the path to the new file. For example, to create a file `token.txt` that contains the GitHub personal access token: ```shell theme={null} op read --out-file token.txt op://development/GitHub/credentials/personal_token ``` ```shell token.txt theme={null} ghp_WzgPAEutsFRZH9uxWYtw ``` You can also use `op read` with secret references to [load secrets into scripts](/cli/secrets-scripts/). For example, to use secret references in place of your Docker username and password with the `docker login` command: ```shell myscript.sh theme={null} #!/bin/bash docker login -u "$(op read op://prod/docker/username)" -p "$(op read op://prod/docker/password)" ``` #### Query parameters You can use secret references with [query parameters](/cli/secret-reference-syntax/#field-and-file-metadata-attributes) to get more information about an item. To get information about item fields or file attachments, include the `attribute` (or `attr`) query parameter with the attribute you want to get. ```shell theme={null} op:///[/

]/?attribute= ``` You can query the following attributes for fields: `type`, `value`, `title`, `id`, `purpose`, `otp` And the following attributes for file attachments: `content`, `size`, `id`, `name`, `type`. For example, to retrieve a one-time password from the one-time password field on a GitHub item: ```shell theme={null} op read "op://development/GitHub/Security/one-time password?attribute=otp" #code-result 359836 ``` To get an SSH key's private key in the OpenSSH format, include the `ssh-format` query parameter with the value `openssh` on a secret reference for the SSH key's `private key` field. ```shell theme={null} op read "op://Private/ssh keys/ssh key/private key?ssh-format=openssh" #code-result -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABD3rRrf8J ruD0CxZTYfpbTYAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIJ5B/GnxX6t9jMwQ G7QE7r5daJLkMKTZhNZhWfvzK2y+AAAAkLgQAivYu/+12/YrZhK5keIAZf4ZgsZsZ2JI2q qbx23PqgO93oGy1iCxXe3kngQL4cM6lwOZPsZPKCinkN6KxEr6RnXqFRHJbMpOiGeZhTuD rjeo77HqFdxDqDeckB77XCKL0Ew28H5JlM/WO31XR3Z4VBAgTe+BQLjrFV8WU5UX38hpBJ PMJyRsK72ZUDDaGQ== -----END OPENSSH PRIVATE KEY----- ``` **Next step** Learn more about [securely loading secrets into scripts](/cli/secrets-scripts/). ### With `op run` You can set environment variables to secret references, then use [`op run`](/cli/reference/commands/run/) to pass secrets to an application or script at runtime. `op run` scans environment variables for secret references, loads the corresponding values from 1Password, then runs the provided command in a subprocess with the secrets made available as environment variables for the duration of the subprocess. When you reference a variable like `$MY_VAR` in the **same command** where you call `op run`, your shell expands `$MY_VAR` before `op run` can substitute the secret reference. To make sure `op run` substitutes the secret before the variable expands, you can either: * **Export the variable** as a secret reference before calling `op run`, or * Set the variable in the same command as `op run`, then **run the command to expand the variable in a subshell**. For example: ```shell theme={null} MY_VAR=op://vault/item/field op run --no-masking -- sh -c 'echo "$MY_VAR"' ``` #### Pass the secrets to an application or script To pass secrets to your script or application at runtime, wrap the command with `op run`. For example, here's a Node.js app that needs credentials to connect to a database: ```shell theme={null} $ node app.js [INFO] Launching Node.js app... [ERROR] Missing credentials DB_USER and DB_PASSWORD [INFO] Exiting with code 1 ``` You can set the `DB_USER` and `DB_PASSWORD` environment variables to secret references: ```shell theme={null} export DB_USER="op://app-dev/db/user" export DB_PASSWORD="op://app-dev/db/password" ``` ```shell theme={null} set -x DB_USER="op://app-dev/db/user" set -x DB_PASSWORD="op://app-dev/db/password" ``` ```powershell theme={null} $Env:DB_USER = "DB_USER=op://app-dev/db/user" $Env:DB_PASSWORD = "DB_PASSWORD=op://app-dev/db/password" ``` Then use `op run` to pass the secrets to the `node app.js` command: ```shell theme={null} op run -- node app.js [INFO] Launching Node.js app... [DEBUG] ✔ Connected to db as user 'mydbuser' with password '' ``` #### Use with environment files You can also use `op run` with environment files. To do this, use secret references instead of plaintext secrets in your environment file: ```html node.env theme={null} DB_USER="op://app-dev/db/user" DB_PASSWORD="op://app-dev/db/password" ``` Then use `op run` with the `--env-file` flag: ```shell theme={null} op run --env-file="./node.env" -- node app.js ``` #### Print a secret with or without masking If a subprocess used with `op run` prints a secret to `stdout`, the secret will be concealed by default. You can include the `--no-masking` flag to print the value. To export an example environment variable `DB_PASSWORD` to a secret reference: ```shell theme={null} export DB_PASSWORD=op://app-prod/db/password ``` Use `op run` with the `printenv` command to print the concealed secret: ```shell theme={null} op run -- printenv DB_PASSWORD #code-result ``` Include the `--no-masking` flag to print the actual secret: ```shell theme={null} op run --no-masking -- printenv DB_PASSWORD #code-result fX6nWkhANeyGE27SQGhYQ ``` To export an example environment variable `DB_PASSWORD` to a secret reference: ```shell theme={null} set -x DB_PASSWORD=op://app-prod/db/password ``` Use `op run` with the `printenv` command to print the concealed secret: ```shell theme={null} op run -- printenv DB_PASSWORD #code-result ``` Include the `--no-masking` flag to print the actual secret: ```shell theme={null} op run --no-masking -- printenv DB_PASSWORD #code-result fX6nWkhANeyGE27SQGhYQ ``` To export an example environment variable `DB_PASSWORD` to a secret reference: ```powershell theme={null} $Env:DB_PASSWORD = "DB_PASSWORD=op://app-prod/db/password" ``` To print the concealed secret: ```powershell theme={null} op run -- powershell -c '$env:DB_PASSWORD' #code-result ``` Include the `--no-masking` flag to print the actual secret: ```powershell theme={null} op run --no-masking -- powershell -c '$env:DB_PASSWORD' #code-result fX6nWkhANeyGE27SQGhYQ ``` **Next step** Learn more about [loading secrets into the environment](/cli/secrets-environment-variables/) with `op run`, including how to use template variables to switch between different sets of secrets for different environments. ### With `op inject` You can use [`op inject`](/cli/reference/commands/inject/) to replace secret references in a script or file with the secrets they reference. By default, `op inject` accepts input on `stdin` and outputs on `stdout`. You can use the `--in-file` flag (or `-i`) to read the input from a file instead, and the `--out-file` flag (or `-o`) to specify where the ouput should be written. To use `op inject` to resolve a secret in a simple command: ```shell theme={null} echo "here is my GitHub token: op://development/GitHub/credentials/personal_token" | op inject #code-result here is my GitHub token: ghp_WzgPAEutsFRZH9uxWYtw ``` To write the output to a file `token.txt` in the current directory: ```shell theme={null} echo "here is my GitHub token: op://development/GitHub/credentials/personal_token" >> token.txt | op inject --out-file token.txt ``` ```shell token.txt theme={null} here is my GitHub token: ghp_WzgPAEutsFRZH9uxWYtw ``` #### Use with configuration files You can use `op inject` to pass in a configuration file templated with secret references and output a configuration file that contains resolved secrets. Configuration files that use secret references instead of plaintext secrets can be safely checked into Git. ```yaml config.yml.tpl theme={null} database: host: http://localhost port: 5432 username: op://prod/mysql/username password: op://prod/mysql/password ``` ```shell theme={null} op inject --in-file config.yml.tpl --out-file config.yml ``` **Next step** Learn more about [loading secrets into configuration files](/cli/secrets-config-files/) with `op inject`, including how to use template variables to switch between different sets of secrets for different environments. ## Learn more * [Secret reference syntax](/cli/secret-reference-syntax/) * [Load secrets into the environment](/cli/secrets-environment-variables/) * [Load secrets into config files](/cli/secrets-config-files/) * [Load secrets into scripts](/cli/secrets-scripts/) * [Use service accounts with 1Password CLI](/service-accounts/use-with-1password-cli) * [Workflow: Secure your developer secrets](/get-started/secure-developer-secrets) # Load secrets into config files Source: https://www.1password.dev/cli/secrets-config-files With 1Password CLI, you can use [secret references](/cli/secret-reference-syntax/) to automatically load secrets into configuration files from your 1Password account without putting any plaintext secrets in code. This allows you to check config files into source control and keep them in sync throughout developer workstations, CI, and production servers, which is otherwise manual and error-prone work. We recommend using [1Password Service Accounts](/service-accounts/) to follow the [principle of least privilege](/cli/best-practices/). Service accounts support restricting 1Password CLI to specific vaults, so that processes in your authorized terminal session can only access items required for a given purpose. ## Requirements Before you can use 1Password to secure your config files, you'll need to: 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. [Install 1Password CLI.](/cli/get-started/#step-1-install-1password-cli) 3. Store the secrets you want to provision in your 1Password account. ## Step 1: Get secret references You can get secret references in several ways: * [With the 1Password desktop app](/cli/secret-reference-syntax/#with-the-1password-desktop-app): Copy secret references from the app. * [With 1Password for VSCode](/vscode/#get-values): Insert secret references from 1Password as you edit code. * [With 1Password CLI](/cli/secret-reference-syntax/#with-1password-cli): Get secret references for one or multiple fields with `op item get`. * Use the [secret reference syntax rules](/cli/secret-reference-syntax/#syntax-rules) to write secret references manually. ## Step 2: Use secret references in your config file Replace the plaintext secrets in your config file with the appropriate secret references, following the [template syntax](/cli/secrets-template-syntax/). For example, if you start with a config file that looks like this: ```yaml config.yml theme={null} database: host: http://localhost port: 5432 username: mysql-user password: piG1rX5P1QMF6J5k7u7sNb ``` And you saved the `username` and `password` secrets on the `mysql` item in the `prod` vault, you would end up with this templated config file: ```yaml config.yml.tpl theme={null} database: host: http://localhost port: 5432 username: op://prod/mysql/username password: op://prod/mysql/password ``` ## Step 2: Inject the secrets To load secrets from the config file and provision them at runtime, use `op inject` to inject the secrets directly into your production environment. For example: ```zsh theme={null} op inject -i config.yml.tpl -o config.yml ``` In the output file, `config.yml`, you'll see the secret references replaced with the plaintext secrets they reference. The config file template is stored together with the code in source control, so that every developer can see the structure of the file. Make sure to delete the resolved config file when you no longer need it. ## Step 3: Differentiate between environments We highly recommend you organize your 1Password items in the same way across all of your environments. For example: `app/dev/db/password` and `app/prod/db/password`. If you do this, you can use variables in your template file to switch to a different set of secrets. You can have variables for your environment, stage, region, or anything else. For example: ```yaml config.yml.tpl theme={null} database: host: http://localhost port: 5432 username: op://$APP_ENV/mysql/username password: op://$APP_ENV/mysql/password ``` You can then set the `APP_ENV` variable when you inject into the template, using the [Template Syntax](/cli/secrets-template-syntax/): ```shell theme={null} APP_ENV=prod op inject -i config.yml.tpl -o config.yml ``` 1. Set `APP_ENV` to `prod`: ```powershell theme={null} $Env:APP_ENV = "prod" ``` 2. Inject the secrets: ```powershell theme={null} op inject -i config.yml.tpl -o config.yml ``` This allows you to use the same template file, stored in source control next to your application, for all your deployments. ## Optional: Use `op inject` in production Now that the application works with the right configuration locally, you can use 1Password CLI to provision secrets in production environments. To do this, you'll first need to: 1. [Install 1Password CLI 2 in your production environment.](/cli/install-server/) 2. [Set up a Secrets Automation workflow](/connect/). 3. [Deploy 1Password Connect Server](/connect/get-started/#step-2-deploy-1password-connect-server) and make it accessible to your production environment. To use 1Password CLI with a Connect server, set the `OP_CONNECT_HOST` and `OP_CONNECT_TOKEN` environment variables to your Connect instance's credentials in your production environment. You can now move your secrets to config files and have them readily accessible with `op inject`. The following commands can be used with a Connect server: * `op run` * `op inject` * `op read` * `op item get` ## Learn more * [Load secrets into the environment](/cli/secrets-environment-variables/) * [Secret reference syntax](/cli/secret-reference-syntax/) * [Template syntax](/cli/secrets-template-syntax/) * [Workflow: Secure your developer secrets](/get-started/secure-developer-secrets) * [Developer quickstart](/get-started/developer-quickstart) # Load secrets into the environment Source: https://www.1password.dev/cli/secrets-environment-variables With [`op run`](/cli/reference/commands/run/), you can provide your project secrets directly from 1Password to an application or script as environment variables at runtime. You can use `op run` with [1Password Environments](/environments), environment variables set to [secret references](/cli/secret-references), or a combination of both. 1Password CLI loads the specified secrets, then runs the provided command in a subprocess with the secrets made available as environment variables only for the duration of the process. This allows you to avoid hardcoding any plaintext secrets and quickly switch between different sets of secrets for different development contexts. ## Choose your configuration 1Password CLI provides multiple methods to load your project secrets: * **[1Password Environments (beta)](/environments)** allow you to create Environments in 1Password that contain all your environment variables for a specific workflow. You can share Environments with your team and create separate Environments for each project, application, or development context (like staging or production). * **[Secret references](/cli/secret-references)** are URIs that point to where a secret is stored in your 1Password account. A secret reference uses the names or unique identifiers of the vault, item, section, and field where the secret is stored in 1Password. You can set environment variables to secret references on the command line or use secret references in your `.env` files. Secret references require more manual setup than 1Password Environments to switch between different sets of environment variables for different contexts, or create shared team workflows. * **Hybrid approach**: You can use `op run` to load variables from a 1Password Environment alongside secret references from `.env` files or exported environment variables. Authenticate with a [1Password Service Account](/service-accounts/) to follow the [principle of least privilege](/cli/best-practices/). You can scope service account access to specific vaults and 1Password Environments so that processes in your authorized terminal session can only access secrets required for a given purpose. You should assume that processes on your computer can access the environment of other processes run by the same user. Be aware of this when supplying secrets through environment variables. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. [Install the latest beta build of 1Password CLI](https://app-updates.agilebits.com/product_history/CLI2#beta), version `2.33.0-beta.02` or later. Before you can load secrets into the environment, you'll need to: 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. [Install 1Password CLI.](/cli/get-started#step-1-install-1password-cli) ## Step 1: Store your project secrets in 1Password To store your project secrets in a 1Password Environment, [follow the steps to create an Environment](/environments), then import a `.env` file or manually add your environment variables. To use secret references, save your project secrets as items in a vault in your 1Password account. Then follow the instructions to create secret references for each item using your preferred method: * [With the 1Password desktop app](/cli/secret-reference-syntax#with-the-1password-desktop-app): Copy secret references from the app. * [With 1Password for VSCode](/vscode#get-values): Insert secret references from 1Password as you edit code. * [With 1Password CLI](/cli/secret-reference-syntax#with-1password-cli): Get secret references for one or multiple fields with `op item get`. * Use the [secret reference syntax rules](/cli/secret-reference-syntax#syntax-rules) to write secret references manually. ## Step 2: Pass the secrets to the application To pass your environment variables from 1Password to an application or script: 1. Open the 1Password app and navigate to **Developer** > **Environments**. 2. Select the Environment where your project secrets are stored, then select **Manage environment** > **Copy environment ID**. 3. Use `op run --` with the command for starting the application or script. 1Password will run the provided command in a subprocess with the secrets made available as environment variables for the duration of the process. ```shell theme={null} op run --environment -- ``` For example: ```shell theme={null} op run --environment blgexucrwfr2dtsxe2q4uu7dp4 -- ./my-script.sh ```

Step 1: Map secret references to environment variables

To pass secrets to an application or script using `op run` and [secret references](/cli/secret-references), you must first map the secret references to the appropriate environment variables. To do this, you can set environment variables to secret references using an environment file or export them on the command line. Environment (`.env`) files allow you to define multiple environment variables as secret references with `KEY=VALUE` statements separated by a newline. To use an environment file with `op run`, add key-value pairs for each of your project secrets with the value set to a [secret reference](/cli/secret-references). For example: ```shell title="prod.env" theme={null} AWS_ACCESS_KEY_ID="op://development/aws/Access Keys/access_key_id" AWS_SECRET_ACCESS_KEY="op://development/aws/Access Keys/secret_access_key" ``` The `.env` file parsing engine follows the following rules: * Environment variables are defined as `KEY=VALUE` statements separated by a newline. * Variables can span multiple lines if they are enclosed in either `'` or `"`: ``` MY_VAR = "this is on the first line and this is on the second line" ``` * Empty lines are skipped. * Lines beginning with `#` are treated as comments. Comments can also be placed inline after `KEY=VALUE` statements. * Empty values become empty strings. For example, `EMPTY=` will set the environment variable `EMPTY` to the empty string. * If a value is surrounded by single or double quotes, these quotes do not end up in the evaluated value. So `KEY="VALUE"` and `KEY='VALUE'` both evaluate to `KEY` and `VALUE`. * Occurrences of `$VAR_NAME` or `${VAR_NAME}` are replaced with their respective value from the environment. * A variable defined in a .env file can be referred to later in the same file: ``` SOME_VAR = value OTHER_VAR = ${SOME_VAR} ``` * Special characters can be escaped with `\`. For example, `MY_VAR = "\$SOME_VAR that is not actually replaced."` results in the following value for MY\_VAR: `$SOME_VAR that is not actually replaced.`. * Inner quotes are maintained, so `JSON={"foo":"bar"}` evaluates to `JSON` and `{"foo":"bar"}`. * Variables do not get replaced in values that are enclosed in single quotes. So `KEY='$SOME_VAR'` evaluates to `KEY` and `$SOME_VAR`. * Template syntax can be used in the `VALUE` to inject secrets. The `KEY` can only contain template variables. * Template parsing is performed after `.env` file parsing, so you cannot use the former to construct the latter. * Leading and trailing whitespace of both `KEY` and `VALUE` segments are ignored, so `KEY = VALUE` is parsed the same as `KEY=VALUE`. * Single and double quoted values maintain both leading and trailing whitespace, so `KEY=" some value "` evaluates to `KEY` and some value . * These files should use UTF-8 character encoding. ### Optional: Differentiate between environments If you need to pass secrets for multiple environments, we recommend using 1Password Environments instead of secret references. 1Password Environments allow you to more easily organize, share, and pass environment variables for multiple contexts. If you have different sets of secrets for different environments, like staging and production, you can check a single environment file into source control and include a variable within the secret references to represent the context. You can then set the variable to the appropriate context when you pass the file to `op run`. To use this approach, you must organize your project secrets in 1Password into different vaults for each environment, with each item's fields structured in the same way. For example: `dev/mysql/password` and `prod/mysql/password`. Then, include an externally set variable (`$VARIABLE_NAME`) in place of the vault name for each secret reference in your environment file. For example, in the following environment file, `$APP_ENV` is the externally set environment variable. It can be set to `dev` or `prod` to load secrets from either the `dev` vault or the `prod` vault in 1Password. ```shell title="app.env" theme={null} MYSQL_DATABASE = "op://$APP_ENV/mysql/database" MYSQL_USERNAME = "op://$APP_ENV/mysql/username" MYSQL_PASSWORD = "op://$APP_ENV/mysql/password" ``` You can individually export environment variables as [secret references](/cli/secret-reference-syntax/) from the command line. For example, to set the variable `GITHUB_TOKEN` to a secret reference URI that points to the `personal_token` field within a `credentials` section in a `GitHub` item: ```shell theme={null} export GITHUB_TOKEN=op://development/GitHub/credentials/personal_token ``` ```shell theme={null} set -x GITHUB_TOKEN op://development/GitHub/credentials/personal_token ``` ```powershell theme={null} $Env:GITHUB_TOKEN = "op://development/GitHub/credentials/personal_token" ```

Step 2: Pass the resolved secret references to the application

To use an environment file with `op run`, specify the path to the environment file using the `--env-file` flag: ```shell theme={null} op run --env-file="./prod.env" -- aws ``` If you structured your environment file to load secrets for multiple environments, make sure to also set the variable for the vault (in the example below, `APP_ENV`). For example, to pass secrets from the `dev` vault to an application running in the development environment: ```shell theme={null} APP_ENV=dev op run --env-file="./app.env" -- myapp deploy ``` 1. Set the `$APP_ENV` variable: ```powershell theme={null} $ENV:APP_ENV = "dev" ``` 2. Run `op run` with the environment file: ```powershell theme={null} op run --env-file="./app.env" -- myapp deploy ``` If you exported environment variables as secret references on the command line, use `op run --` with the command to start the application or script. 1Password will run the provided command in a subprocess with the secrets made available as environment variables for the duration of the process. ```shell theme={null} op run -- ``` For example: ```shell theme={null} op run -- gh ``` **Expand variables in a subshell** When you reference a variable like `$MY_VAR` in the same command where you call `op run`, your shell expands `$MY_VAR` before `op run` can substitute the secret reference. For example, a command like the following will pass the secret reference URI instead of the secret value from 1Password: ```shell theme={null} MY_VAR=op://vault/item/field op run --no-masking -- echo "$MY_VAR" ``` To make sure `op run` substitutes the secret before the variable expands, run the command to expand the variable in a subshell: ```shell theme={null} MY_VAR=op://vault/item/field op run --no-masking -- sh -c 'echo "$MY_VAR"' #code-result open skdjfs7dyrwhk4jhref ``` **Use both methods together** You can load environment variables from an Environment in combination with secret references from a `.env` file or flag. For example: ```shell theme={null} op run --environment --env-file="./extra-secrets.env" -- ``` ## Next step: Run in production Now that the application works locally, choose how to load your secrets in production or CI/CD: * **[1Password Service Account](/service-accounts/use-with-1password-cli)**: Automate access with a service account token. Service accounts support both secret references and 1Password Environments. * **[1Password Connect Server](/connect/cli/)**: Best for self-hosting within your own infrastructure. Connect only supports secret references and does not currently support 1Password Environments. ## Learn more * [Use 1Password Service Accounts with 1Password CLI](/service-accounts/use-with-1password-cli) * [Use 1Password Connect Server with 1Password CLI](/connect/cli#continuous-integration-ci-environments) * [Load secrets into config files](/cli/secrets-config-files/) * [Secret reference syntax](/cli/secret-reference-syntax/) * [Template syntax](/cli/secrets-template-syntax/) * [Workflow: Secure your deployments](/get-started/secure-deployment) # Load secrets into scripts Source: https://www.1password.dev/cli/secrets-scripts You can use 1Password CLI to load secrets into your scripts, so that the credentials in your scripts are always in sync with the information in your 1Password account and your secrets are never exposed in plaintext. We recommend using [1Password Service Accounts](/service-accounts/) to follow the [principle of least privilege](/cli/best-practices/). Service accounts support restricting 1Password CLI to specific vaults, so that processes in your authorized terminal session can only access items required for a given purpose. Service accounts are also useful if your personal account has SSO or MFA requirements. You can use the following methods to load secrets into scripts, separately or in combination: 1. [Use `op run` to pass environment variables from a 1Password Environment](#use-op-run-to-pass-environment-variables-from-a-1password-environment-beta) 2. [Use `op run` to load secrets into the environment.](#use-op-run-to-pass-secrets-using-secret-references) 3. [Use `op read` to read secrets.](#use-op-read-to-read-secrets) 4. [Use `op inject` to load secrets into a config file.](#use-op-inject-to-load-secrets-into-a-config-file) 5. [Use `op plugin run` to load secrets using a shell plugin.](#use-op-plugin-run-to-load-secrets-using-a-shell-plugin) Follow the build integrations workflow guide to choose the right authentication method and configuration for your use case. ## Requirements Before you can use 1Password CLI to load secrets into your scripts, you'll need to: 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. [Install 1Password CLI.](/cli/get-started#step-1-install-1password-cli) 3. Store the secrets you need for your script in your 1Password account. ## Use `op run` to pass environment variables from a 1Password Environment (beta) **Beta feature** To use `op run` with 1Password Environments, you'll need to install the [latest beta build of 1Password CLI](https://app-updates.agilebits.com/product_history/CLI2#beta), version `2.33.0-beta.02` or later. You can use [`op run`](/cli/reference/commands/run/) to [pass environment variables](/cli/secrets-environment-variables) stored in a [1Password Environment](/environments) to an application or script at runtime. 1Password CLI runs the application or script in a subprocess with the environment variables stored in your 1Password Environment provisioned for the duration of the process. ## Use `op run` to pass secrets using secret references You can replace the plaintext secrets in your environment files with [secret reference URIs](/cli/secret-reference-syntax/) that reference where your project secrets are stored in your 1Password account, then use [`op run`](/cli/reference/commands/run/) to load the corresponding secrets from 1Password and pass them to your script as environment variables at runtime. Learn more about [loading secrets into the environment](/cli/secrets-environment-variables/). ## Use `op read` to read secrets You can use `op read` with secret references [directly in your script](#directly-in-your-script) or [with environment variables](#with-environment-variables). ### Directly in your script With this method, secrets are only passed to the single command that includes the secret reference. For example, to replace your Docker username and password with [secret references](/cli/secret-reference-syntax/) in a command to log in to Docker: ```shell title="yourscript.sh" theme={null} #!/bin/bash docker login -u "$(op read op://prod/docker/username)" -p "$(op read op://prod/docker/password)" ``` ### With environment variables You can also include a command to set environment variables to `op read` and [secret references](/cli/secret-reference-syntax/) in your script. For example, if you supply an AWS command in your script with secrets using the `AWS_SECRET_ACCESS_KEY` and `AWS_ACCESS_KEY_ID` environment variables, your script might look like this: ```shell title="yourscript.sh" theme={null} #!/bin/bash export AWS_SECRET_ACCESS_KEY="$(op read op://prod/aws/secret-key)" export AWS_ACCESS_KEY_ID="$(op read op://prod/aws/access-key-id)" aws sts get-caller-identity ``` ## Use `op inject` to load secrets into a config file If your script uses a configuration file, you can template the config file with [secret references](/cli/secret-reference-syntax/), then use [`op inject`](/cli/reference/commands/inject/) to pass the config file with the resolved secrets to your script at runtime. This allows you to check config files into source control and keep them in sync throughout developer workstations, CI, and production servers. And you can include template variables within the secret references to [load different sets of secrets for different environments](/cli/secrets-config-files#step-3-differentiate-between-environments). [Learn how to load secrets into config files](/cli/secrets-config-files/). ## Use `op plugin run` to load secrets using a shell plugin If your script runs interactively and each person using the script authenticates with their own personal token, you can minimize the configuration required in advance of using the script with a [1Password Shell Plugin](/cli/shell-plugins/). Shell plugins prompt each user to select their credentials when the script is executed. Each person using the script will be prompted to configure when their credentials should be used to authenticate. To make sure the credentials they selected will also be used for future invocations of the script, they can configure their credentials as a global or directory default. To use a shell plugin to authenticate an individual command, wrap the command in [`op plugin run`](/cli/reference/management-commands/plugin#plugin-run). For example, to use the AWS shell plugin to provide an AWS Access Key and Secret Key ID to the `sts get-caller-identity` command: ```shell title="yourscript.sh" theme={null} #!/bin/bash op plugin run -- aws sts get-caller-identity ``` To use a shell plugin throughout a script, you can include an alias for the tool's executable command at the beginning of the script. For example, in this script, the AWS shell plugin would be used to supply secrets for every `aws` command in the script. ```shell title="yourscript.sh" theme={null} #!/bin/bash alias aws="op plugin run -- aws" aws sts get-caller-identity ``` If a shell plugin doesn't exist for the tool you're using, you can [build a new plugin](/cli/shell-plugins/contribute/). ## Learn more * [Example CLI scripts](/cli/scripts/) * [Get started with secret references](/cli/secret-references/) * [Load secrets into the environment](/cli/secrets-environment-variables/) * [Load secrets into config files](/cli/secrets-config-files/) * [Use 1Password Shell Plugins to securely authenticate third-party CLIs](/cli/shell-plugins/) * [Workflow: Secure your developer secrets](/get-started/secure-developer-secrets) # Template syntax Source: https://www.1password.dev/cli/secrets-template-syntax You can create a templated config file that contains [secret references](/cli/secret-reference-syntax/), then [use op inject](/cli/secrets-config-files/) to receive a resolved config file that contains the actual secrets. Here's an example of a template file with enclosed secret references in place of the plaintext secrets: ```yml config.yml.tpl theme={null} database: host: localhost port: 5432 username: {{ op://prod/database/username }} password: {{ op://prod/database/password }} ``` ## Secret references Secret references included in template files can be formatted as either [unenclosed secret references](#unenclosed-secret-references) or [enclosed secret references](#enclosed-secret-references). ### Unenclosed secret references ```shell theme={null} op://test-app/database/password ``` An unenclosed secret reference is a string that: * Begins with `op://` and is not preceded by any of the characters from: `alphanumeric`, `-`, `+` , `\`, `.`. * Ends with either the end of the template, or the first encountered character outside the following set: `alphanumeric`, `-`, `?`, `_`, `.`. Examples of good and bad unenclosed secret references: ```yml theme={null} op://prod/docker-credentials/username ``` ```yml theme={null} op://d3v/stripe.keys/s3ct10n/public_key ``` ```yml theme={null} op://h?ack/1Password!/for"real ``` (contains special characters that are not supported by the syntax) ```yml theme={null} op://{vault}/[item]/(section)/field ``` (contains special characters that are not supported by the syntax) ### Enclosed secret references ```shell theme={null} {{ op://test-app/database/password }} ``` An enclosed secret reference is defined as any string that satisifies all of the following: * Begins with two closed braces `{{` * Ends with the two closed braces `}}` * Contains a valid unenclosed secret reference between the two pairs of braces, possibly padded with spaces Examples of good and bad enclosed secret references: ```yml theme={null} {{op://prod/docker-credentials/username}} ``` ```yml theme={null} {{ op://d3v/stripe.keys/s3ct10n/public_key }} ``` ```yml theme={null} {{op://h?ack/1Password!/for"real}} ``` (the secret reference contains unsupported characters) ### Special characters If you need to escape special characters in your template, you can use curly braces and double quotes: ```yml theme={null} {{ "{{ test op://prod/docker-credentials/username }}" }} will be resolved to {{ test op://prod/docker-credentials/username }} ``` If the content contains double quotes, they must be escaped with `\`: ```yml theme={null} {{ "{{ test \"test\" test }}" }} will be resolved to {{ test "test" test }} ``` ## Variables The template syntax also supports variable tags: * `$var` (unenclosed variables) * `${var}` (enclosed variables) When resolving an unenclosed variable of the form `$FOO`, it is replaced with the value of the environment variable named `FOO`. When resolving an enclosed variable of the form `${FOO}`, any whitespace at the beginning or end of `FOO` is discarded and the reference is replaced with the value of the environment variable named `FOO`. Variable names are case-insensitive, cannot start with a number, and can only contain letters, numbers, and underscores. Examples of good and bad unenclosed variables: ```yml theme={null} $my_var ``` ```yml theme={null} $mY_2nd_vAr ``` ```yml theme={null} $2nd_var ``` (starts with a number) ```yml theme={null} $var-?notvar! ``` (contains unsupported special characters) Examples of good and bad enclosed variables: ```yml theme={null} ${my_var} ``` ```yml theme={null} ${ mY_2nd_vAr } ``` ```yml theme={null} ${my_var\} ``` (the closing brace is escaped) ### Default values To set a default value for a template variable, use this syntax: `${VAR_NAME:-}` The default value will be used when the variable can't be found in the environment. For example, `op://${VAULT:-dev}/docker/password` evaluates to `op://dev/docker/password` when the `VAULT` environment variable isn't set. If `VAULT` is set to `prod` instead, it will evaluate to `op://prod/docker/password`. ## Learn more * [Load secrets into config files](/cli/secrets-config-files/) * [Load secrets into the environment](/cli/secrets-environment-variables/) * [Secret reference syntax](/cli/secret-reference-syntax/) * [Workflow: Secure your developer secrets](/get-started/secure-developer-secrets) * [Developer quickstart](/get-started/developer-quickstart) # Use 1Password Shell Plugins to securely authenticate any CLI Source: https://www.1password.dev/cli/shell-plugins With 1Password Shell Plugins, you can configure 1Password to securely authenticate third-party CLIs with your fingerprint, Apple Watch, or system authentication. Your CLI credentials are stored in your 1Password account, so you never have to manually enter your credentials or store them in plaintext. You can [test shell plugins](/cli/shell-plugins/test/) or choose a shell plugin from the [list below](#get-started) to get started. Shell plugins are compatible with the following shells: * Bash * Zsh * fish ## Get started ## Your favorite tool not listed? Find out how to [build your own plugin](/cli/shell-plugins/contribute/). # Use 1Password to securely authenticate the Akamai CLI Source: https://www.1password.dev/cli/shell-plugins/akamai The Akamai CLI shell plugin allows you to use 1Password to securely authenticate [the Akamai CLI ](https://techdocs.akamai.com/developer/docs/about-clis) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate the Akamai CLI with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.13.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. Install [the Akamai CLI. ](https://techdocs.akamai.com/developer/docs/about-clis) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

If this is your first time installing a shell plugin, you'll also need to add the source command to your RC file or shell profile to persist the plugin beyond the current terminal session. For example:

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference 1Password authenticates with Akamai by injecting a temporary config file with the credentials required by the plugin commands directly from your 1Password account. If you saved your Akamai CLI credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below. If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields. | 1Password field name | `.edgerc` field | | -------------------- | --------------- | | Client Secret | `client_secret` | | Host | `host` | | Access Token | `access_token` | | Client Token | `Client_token` | *Thanks to [@wongle](https://github.com/wongle) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/234)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute/).*

Learn more

# Use 1Password to securely authenticate Argo CD CLI Source: https://www.1password.dev/cli/shell-plugins/argo-cd The Argo CD shell plugin allows you to use 1Password to securely authenticate [Argo CD CLI ](https://argo-cd.readthedocs.io/en/stable/user-guide/commands/argocd/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate Argo CD CLI with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.13.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. Install [Argo CD CLI ](https://argo-cd.readthedocs.io/en/stable/cli_installation/). The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | AuthToken | `ARGOCD_AUTH_TOKEN` | | Address (optional) | `ARGOCD_SERVER` | *Thanks to [@ssttehrani](https://github.com/ssttehrani) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/145)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute/).*

Learn more

# Use 1Password to securely authenticate the AWS CLI Source: https://www.1password.dev/cli/shell-plugins/aws The AWS shell plugin allows you to use 1Password to securely authenticate [the AWS CLI ](https://aws.amazon.com/cli/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate the AWS CLI with biometrics. If you use `cdk`, you can also set up the [AWS CDK Toolkit shell plugin](/cli/shell-plugins/aws-cdk-toolkit/). If you use `eksctl`, you can set up the [eksctl shell plugin](/cli/shell-plugins/eksctl/).

## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.9.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. Install [the AWS CLI. ](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) After you install the AWS CLI, make sure you have an AWS config file at `~/.aws/config` on Mac or Linux, or `C:\Users\USERNAME\.aws\config` on Windows. If you don't have a config file: 1. Use [`aws configure` ](https://docs.aws.amazon.com/cli/latest/reference/configure/) to create one. 2. When prompted, skip entering your AWS access key pair to avoid writing your credentials on disk in the `.aws/credetials` file. The following shells are supported: * Bash * Zsh * fish ## Before you begin: Create and save an AWS access key If you've already created an AWS access key, [skip to Step 1](#step-1-configure-your-default-credentials). If you haven't created an access key yet, you can create one and use the [1Password browser extension](https://support.1password.com/getting-started-browser/) to quickly save it in 1Password:

1. Open and unlock [1Password in your browser](https://support.1password.com/getting-started-browser/). 2. [Follow the steps](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html?icmpid=docs_iam_console#Using_CreateAccessKey) to create an access key for the AWS CLI. 3. On the "Retrieve access keys" page, select **Show** to reveal the secret access key. 4. Select **Save item** when 1Password asks if you want to save an item for the AWS access key. 5. Choose the vault where you want to save the item, edit the item's name and details, then select **Save item**.

The pop-up screen to save your AWS access key in 1Password.

## Step 1: Configure your default credentials **If you use AWS in multiple environments** If you want to use the AWS shell plugin in multiple environments, like production and development, [learn how to set up your plugin for seamless context switching](/cli/shell-plugins/environments/). ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk After you save your AWS credentials in 1Password, you can remove all local copies you currently have stored on disk. Plaintext access keys are commonly stored in your AWS [shared credentials file ](https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/creds-file.html) (default location: `~/.aws/credentials`). If you remove your credentials from this file, make sure to configure shell plugins for any other tools that use the file to authenticate to AWS, like [Terraform](/cli/shell-plugins/terraform/). ## Optional: Assume multiple roles You can use the AWS shell plugin to assume multiple roles in the same way you'd assume roles with the AWS CLI, by defining role profiles [in your AWS config file. ](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-role-prepare) For example: ```html ~/.aws/config theme={null} [profile prod] role_arn = arn:aws:iam::123456789012:role/prod source_profile = wendyappleseed ``` Then include the `--profile` flag to call an AWS command using a role. For example: ```shell theme={null} aws sts get-caller-identity --profile prod ``` If you want to always use the same profile, you can set the `AWS_PROFILE` environment variable. In that case, the `--profile` flag would only be needed to override the default set in the environment. For example: ```shell theme={null} export AWS_PROFILE=prod ``` ## Optional: Set up multi-factor authentication If you use [multi-factor authentication ](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html) with AWS, you can configure the AWS shell plugin to provide your one-time password. You can do this in two ways: * [Add the ARN for your multi-factor authentication device to a profile in your AWS config file. ](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-configure-role-mfa) * Add the one-time password code and ARN to the item in 1Password where your AWS credentials are stored. If you choose this option, your multi-factor authentication information will be treated as your `default` profile and used globally with every other profile.

Save your one-time password and ARN in 1Password

Step 1: Save your QR code

2. Open and unlock the 1Password app. 3. Select the item where your AWS credentials are saved, then select **Edit**. 4. Select **Add More** > **One-Time Password**. 5. [Follow the steps to enable a virtual multi-factor authentication device](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html) for your AWS account. 6. Select **Show secret key** in the AWS wizard, then copy the string of characters into the One-Time Password field on your item. 7. Select **Save**. Your item will now show a one-time password that you can use to finish the AWS multi-factor authentication device set-up flow.

Your edited item must include the `one-time password` and `mfa serial` fields: The AWS item in 1Password with MFA credentials added.

Step 2: Save the ARN for your multi-factor authentication device

1. Find the [ARN for your multi-factor authentication device](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_checking-status.html) and copy it. 2. Open and unlock the 1Password app. 3. Select the item where you saved your AWS credentials then select **Edit**. 4. Select **Add More** > **Text**. 5. Paste the ARN as the value of the field. 6. Title the field `mfa serial`. 7. Select **Save**. 1Password CLI will detect your multi-factor authentication credentials if they're saved in fields titled `one-time password` and `mfa serial`. If your one-time password isn't detected, make sure your fields are titled correctly. 1Password CLI will then set the `AWS_SECRET_ACCESS_KEY`, `AWS_ACCESS_KEY_ID` and `AWS_SESSION_TOKEN` provisional environment variables to specify the temporary multi-factor authentication session values. ## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field names | Environment variables | | ------------------------- | ----------------------- | | Access Key ID | `AWS_ACCESS_KEY_ID` | | Secret Access Key | `AWS_SECRET_ACCESS_KEY` | | Default region (optional) | `AWS_DEFAULT_REGION` |

Learn more

# Use 1Password to securely authenticate the AWS CDK Toolkit Source: https://www.1password.dev/cli/shell-plugins/aws-cdk-toolkit The AWS CDK Toolkit shell plugin allows you to use 1Password to securely authenticate the [AWS CDK Toolkit ](https://docs.aws.amazon.com/cdk/v2/guide/cli.html) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate the AWS CDK Toolkit with biometrics. You can also set up the [AWS CLI shell plugin](/cli/shell-plugins/aws/) or the [eksctl shell plugin](/cli/shell-plugins/eksctl/). ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.17.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. [Install the AWS CDK Toolkit ](https://docs.aws.amazon.com/cdk/v2/guide/cli.html). 6. Make sure you have an AWS config file at `~/.aws/config` on Mac or Linux, or `C:\Users\USERNAME\.aws\config` on Windows. If you don't have a config file, use [`aws configure` ](https://docs.aws.amazon.com/cli/latest/reference/configure/) to create one. When prompted, skip entering your AWS access key pair to avoid writing your credentials on disk in the `.aws/credetials` file. The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

Learn more

# Use 1Password to securely authenticate the AWS SAM CLI Source: https://www.1password.dev/cli/shell-plugins/aws-sam-cli The AWS SAM CLI shell plugin allows you to use 1Password to securely authenticate [AWS SAM CLI ](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/reference-sam-cli.html) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate AWS SAM CLI with biometrics. You can also set up the [AWS CLI shell plugin](/cli/shell-plugins/aws/). ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.34.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. [Install AWS SAM CLI. ](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/reference-sam-cli.html) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field names | Environment variables | | --------------------- | ----------------------- | | Access Key ID | `AWS_ACCESS_KEY_ID` | | Secret Access Key | `AWS_SECRET_ACCESS_KEY` | *Thanks to [@simonmcc](https://github.com/simonmcc) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/473)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute/).* # Use 1Password to securely authenticate awslogs Source: https://www.1password.dev/cli/shell-plugins/awslogs The `awslogs` shell plugin allows you to use 1Password to securely authenticate [`awslogs` ](https://github.com/jorgebastida/awslogs) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate `awslogs` with biometrics. You can also set up the [AWS CLI shell plugin](/cli/shell-plugins/aws/). ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.34.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. [Install `awslogs`. ](https://github.com/jorgebastida/awslogs) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials awslogs} /> ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI awslogs} /> ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help awslogs} /> ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field names | Environment variables | | --------------------- | ----------------------- | | Access Key ID | `AWS_ACCESS_KEY_ID` | | Secret Access Key | `AWS_SECRET_ACCESS_KEY` | *Thanks to [@jonasws](https://github.com/jonasws) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/504)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute/).* # Use 1Password to securely authenticate Axiom CLI Source: https://www.1password.dev/cli/shell-plugins/axiom The Axiom CLI shell plugin allows you to use 1Password to securely authenticate [Axiom CLI ](https://axiom.co/docs/reference/cli) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate Axiom CLI with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.x.x or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Connect 1Password CLI with the 1Password app](/cli/app-integration/). 5. [Install Axiom CLI. ](https://axiom.co/docs/reference/cli) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | Token | `AXIOM_TOKEN` | | Organization | `AXIOM_ORG_ID` | | Deployment | `AXIOM_DEPLOYMENT` | *Thanks to [@rajapri28613](https://github.com/rajapri28613) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/342)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute).* # Use 1Password to securely authenticate Binance CLI Source: https://www.1password.dev/cli/shell-plugins/binance The Binance shell plugin allows you to use 1Password to securely authenticate [Binance CLI ](https://github.com/binance/binance-cli) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate Binance CLI with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.22.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Connect 1Password CLI with the 1Password app](/cli/app-integration/). 5. [Install Binance CLI. ](https://github.com/binance/binance-cli) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | API Key | `BINANCE_API_KEY` | | API Secret | `BINANCE_API_SECRET` | *Thanks to [@bala-ceg](https://github.com/bala-ceg) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/391)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute).* # Use 1Password to securely authenticate the Cachix CLI Source: https://www.1password.dev/cli/shell-plugins/cachix The Cachix shell plugin allows you to use 1Password to securely authenticate [the Cachix CLI ](https://docs.cachix.org) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate the Cachix CLI with biometrics.

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | Token | `CACHIX_AUTH_TOKEN` | *Thanks to [@micnncim](https://github.com/micnncim) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/97)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute/).*

Learn more

# Use 1Password to securely authenticate Cargo CLI Source: https://www.1password.dev/cli/shell-plugins/cargo The Cargo CLI shell plugin allows you to use 1Password to securely authenticate [Cargo CLI ](https://crates.io/crates/cargo-cli) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate Cargo CLI with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.13.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. Install [Cargo CLI. ](https://crates.io/crates/cargo-cli) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | ---------------------- | | Token | `CARGO_REGISTRY_TOKEN` | *Thanks to [@accraw](https://github.com/accraw) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/139)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute/).*

Learn more

# Use 1Password to securely authenticate the CircleCI CLI Source: https://www.1password.dev/cli/shell-plugins/circleci The CircleCI shell plugin allows you to use 1Password to securely authenticate [the CircleCI CLI ](https://circleci-public.github.io/circleci-cli/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate the CircleCI CLI with biometrics.

1. Open and unlock [1Password in your browser](https://support.1password.com/getting-started-browser/). 2. [Follow the steps](https://circleci.com/docs/managing-api-tokens/#creating-a-personal-api-token) to create a CircleCI personal API token. 3. Select **Save item** when 1Password asks if you want to save an item for the CircleCI personal API token. 4. Choose the vault where you want to save the item, edit the item's name and details, then select **Save item**.

The prompt to save your CircleCI personal API token in 1Password.

## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | Token | `CIRCLECI_CLI_TOKEN` |

Learn more

# Use 1Password to securely authenticate Civo CLI Source: https://www.1password.dev/cli/shell-plugins/civo The Civo CLI shell plugin allows you to use 1Password to securely authenticate [Civo CLI ](https://www.civo.com/docs/overview/civo-cli) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate Civo CLI with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.22.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Connect 1Password CLI with the 1Password app](/cli/app-integration/). 5. [Install Civo CLI. ](https://www.civo.com/docs/overview/civo-cli) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | API Key | `CIVO_API_KEY` | | API Key ID | `CIVO_API_KEY_NAME` | *Thanks to [@siddhikhapare](https://github.com/siddhikhapare) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/325)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute).* # Use 1Password to authenticate Claude Code with biometrics Source: https://www.1password.dev/cli/shell-plugins/claude-code The Claude Code shell plugin allows you to use your Anthropic API key through 1Password to securely authenticate the [`claude` CLI ](https://docs.anthropic.com/en/docs/agents-and-tools/claude-code/overview) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to store your API key in 1Password and source the `plugins.sh` file, then you'll be prompted to authenticate the `claude` CLI with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.34.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. Install [Claude Code ](https://code.claude.com/docs/en/overview) in your terminal and [create an Anthropic API key. ](https://console.anthropic.com/settings/keys) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | API Key | `ANTHROPIC_API_KEY` | *Thanks to [@malob](https://github.com/malob) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/519)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute).* ## Learn more

# Use 1Password to securely authenticate the Cloudflare Workers CLI Source: https://www.1password.dev/cli/shell-plugins/cloudflare-workers The Cloudflare Workers shell plugin allows you to use 1Password to securely authenticate [Wrangler ](https://developers.cloudflare.com/workers/wrangler/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate Wrangler with biometrics.

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | --------------------- | ----------------------- | | Account ID (Optional) | `CLOUDFLARE_ACCOUNT_ID` | | Token | `CLOUDFLARE_API_TOKEN` | *Thanks to [@shyim](https://github.com/shyim) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/94)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute/).*

Learn more

# Build your own shell plugins (beta) Source: https://www.1password.dev/cli/shell-plugins/contribute If you don't see your favorite command-line tool [listed in the 1Password Shell Plugin registry](/cli/shell-plugins/), you can write your own plugin. 1Password CLI allows you to build and test shell plugins locally, so you can add support for authenticating your favorite CLI using a credential you saved in 1Password. If you want to make your plugin available to others, you can [create a pull request in the shell plugins GitHub repository](https://github.com/1Password/shell-plugins). ## Requirements * [Sign up for 1Password](https://1password.com/pricing/password-manager). * Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). * Install [1Password CLI](/cli/get-started/) and turn on the [desktop app integration](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). * Install [Go 1.18 or later](https://go.dev/doc/install). * Install [Git](https://git-scm.com/). * Install [GNU Make](https://www.gnu.org/software/make/). ## Concepts A 1Password Shell Plugin should describe the following: * The **credential** offered by a platform * The CLI or **executable** offered by a platform * How the credential should be **provisioned** for the respective CLI to authenticate * Which commands for the respective CLI **need authentication** * How credentials stored on the local filesystem can be **imported** into 1Password Shell plugins are written in Go and consist of a set of Go structs in a package that together make up the plugin for a certain platform, service, or product. Don't worry if you're not a Go expert – there are [lots of examples](https://github.com/1Password/shell-plugins/tree/main/plugins) you can learn from to build your plugin! ## Step 1: Use the plugin template First, clone or fork the [1Password Shell Plugins repository](https://github.com/1Password/shell-plugins) on GitHub. It contains the current plugin registry, as well as the SDK needed to contribute. To get started with those, use the following Makefile command: ```shell theme={null} make new-plugin ``` You'll be prompted to enter the following information: * **Plugin name:** Lowercase identifier for the platform, e.g. `aws`, `github`, `digitalocean`, `azure`. This will also be used as the name of the Go package. * **Plaform display name:** The display name of the platform, e.g `AWS`, `GitHub`, `DigitalOcean`, `Azure`. * **Credential name:** The credentials the platform offers, e.g. `Personal Access Token`, `API Key`, `Auth Token`. * **Executable name:** The command to invoke, e.g. `aws`, `gh`, `doctl`, `az`. After filling in the form, you'll see a Go package created in the `plugins` directory, with separate files for the plugin, credential, and executable. For example: ``` plugins/ ├── aws/ │ ├── plugin.go │ ├── access_key.go │ └── aws.go ├── digitalocean/ │ ├── plugin.go │ ├── personal_access_token.go │ └── doctl.go ├── github/ │ ├── plugin.go │ ├── personal_access_token.go │ └── gh.go └── heroku/ ├── plugin.go ├── api_key.go └── heroku.go ``` To save you some time, the generated files will be stubbed out with information that's derived from the Makefile prompts on a best-effort basis. It contains *TODO* comments in the code to steer you in the direction of what to change or validate for correctness. ## Step 2: Edit the plugin definition The `plugin.go` file contains basic information about the plugin and the platform it represents, including which credential types and executables make up the plugin. ### Plugin Examples * [AWS](https://github.com/1Password/shell-plugins/blob/main/plugins/aws/plugin.go) * [GitHub](https://github.com/1Password/shell-plugins/blob/main/plugins/github/plugin.go) * [Heroku](https://github.com/1Password/shell-plugins/blob/main/plugins/heroku/plugin.go) ## Step 3: Edit the credential definition The credential definition file describes the schema of the credential, how the credential should get provisioned to executables, and how the credential can be imported into 1Password. ### Credential Examples * [AWS Access Key](https://github.com/1Password/shell-plugins/blob/main/plugins/aws/access_key.go) * [GitHub Personal Access Token](https://github.com/1Password/shell-plugins/blob/main/plugins/github/personal_access_token.go) * [Heroku API Key](https://github.com/1Password/shell-plugins/blob/main/plugins/heroku/api_key.go) ### Credential information and schema The first section of the credential definition is where you can add information about the credential: * The **name** of the credential, as the platform calls it. * The **documentation URL** provided by the platform that describes the credential. *(optional)* * The **management URL** on the platform where the credential can be created and revoked. This is usually a URL to the dashboard, console, or authentication settings of the platform. *(optional)* The next section is where you define the schema of the credential. This is segmented into fields. Many credentials consist of just a single secret field, but you can add more fields to add more details to the 1Password item that are related to authentication, even if the fields are not secret. Examples of additional fields are: the host, username, account ID, and all other things that are needed to authenticate and make sense to include in the 1Password item for the credential type. All fields you declare here will also show up in the end user's 1Password item. Here's what you can specify per **field**: * The **field name**, titlecased. *(required)* * A short **description** of the field. This supports markdown. *(required)* * Whether the field is **optional**. Defaults to false. * Whether the field is **secret**, and should be concealed in the 1Password GUI. Defaults to not secret.
Note: The credential schema is expected to contain at least 1 secret field. * What the actual credential **value is composed of**. The length, character set, and whether it contains a fixed prefix. ### Provisioner The credential definition also specifies how the credential is usually provisioned to exectuables, in order for them to use the credential for authentication. Provisioners are in essence hooks that get executed before the executable is run by 1Password CLI, and after the executable exits in case any cleanup is needed. In those hooks, provisioners can do all the setup required for the executable to authenticate, including setting environment variables, creating files, adding command-line arguments, or even generating temporary credentials. After the executable exits, there should be no trace of the credentials on the user's filesystem. The SDK provides a few common provisioners out of the box, so in most cases you don't have to care about the provisioning internals. We currently recommend using environment variables as your provisioning method. Environment variables are the most ubiquitous way to provision secrets. They only live in memory, and almost every CLI allows you to authenticate with them. Here's how you can use the environment variable provisioner provided by the SDK: ```go theme={null} provision.EnvVars(map[string]sdk.FieldName{ "AWS_ACCESS_KEY_ID": fieldname.AccessKeyID, "AWS_SECRET_ACCESS_KEY": fieldname.SecretAccessKey, }) ``` Specify the 1Password field name and the environment variable name it should be placed in. To figure out what environment variable the underlying CLI reads, here are a few tips: * Search the platform's CLI documentation website for a getting started guide, authentication guide, or CLI reference docs. * Look at the CLI's help text or manpage. * If the CLI or the underlying SDK it uses is open source, scan the source code to see if it accepts environment variables for authentication. Some CLIs only support reading credentials from files on disk. In that case, you can use the file provisioner provided by the SDK. The file provisioner takes care of creating the file in a temporary directory and deleting it afterwards. For security purposes, the file created by the file provisioner can only be read **once** by the executable. If that limitation does not work for your use case, you can file an [issue on GitHub](https://github.com/1Password/shell-plugins/issues). Here are a few examples on how you can use the file provisioner to provision a temporary JSON file and pass the generated path to the executable: ```go Create a file provisioner and pass output path as --config-file theme={null} provision.TempFile(configFile, provision.Filename("config.json"), provision.AddArgs("--config-file", "{{ .Path }}"), ) ``` ```go Create a file provisioner and set output path as CONFIG_FILE_PATH theme={null} provision.TempFile(configFile, provision.Filename("config.json"), provision.SetPathAsEnvVar("CONFIG_FILE_PATH"), ) ``` ```go Create a file provisioner and pass output path as Java property theme={null} provision.TempFile(configFile, provision.Filename("config.json"), provision.AddArgs(`-Dconfig.path="{{ .Path }}"`), ) ``` ```go Code to generate JSON file contents theme={null} func configFile(in sdk.ProvisionInput) ([]byte, error) { config := Config{ Token: in.ItemFields[fieldname.Token] } contents, err := json.Marshal(config) if err != nil { return nil, err } return []byte(contents), nil } type Config struct { Token string `json:"token"` } ``` If the standard provisioners included in the SDK are not enough to authenticate the executable, you can also write your own provisioner. You can do so by implementing the [`sdk.Provisioner` interface](https://github.com/1Password/shell-plugins/blob/main/sdk/provisioner.go). A good example of a custom provisioner is the [AWS STS provisioner](https://github.com/1Password/shell-plugins/blob/main/plugins/aws/sts_provisioner.go) that generates temporary credentials based on a one-time password code loaded from 1Password. ### Importer The credential definition also lets you specify importers. Importers are responsible for scanning the user's environment and file system for any occurrences of the needed credentials. 1Password CLI will run the importer and prompt the user to import their credentials one by one into 1Password. It's very common for CLIs to write authentication data to disk, most commonly in a hidden config file in your home directory. This is not always documented by the CLI, so here are some tips to figure out if such a config file exists: * Check the platform's documentation for mentions of config files. * See if the CLI offers a `login`, `auth`, `configure`, or `setup` command that covers authentication. If it does, it's pretty likely there's a credential being stored in your home directory after completing such a flow. * If the CLI is open source, check the source code to see if such a file exists. * Look at your own home directory or `~/.config` directory to see if there are files related to the platform. Here's an example command to find local `aws` configuration files: ```shell theme={null} find ~/.* -maxdepth 3 -path "*aws*" ``` The SDK provides helper functions to load files, parse files, and scan environment variables to make writing an importer for your credential type easier. ### Importer Examples * [AWS Access Key](https://github.com/1Password/shell-plugins/blob/main/plugins/aws/access_key.go) (`~/.aws/credentials`) * [CircleCI Personal API Token](https://github.com/1Password/shell-plugins/blob/main/plugins/circleci/personal_api_token.go) (`~/.circleci/cli.yml`) * [Heroku API Key](https://github.com/1Password/shell-plugins/blob/main/plugins/heroku/api_key.go) (`~/.netrc`) If you already have a shell plugin configured for a tool, and you want to generate an example configuration tile to test an importer, reference the tool by its full path rather than by its name. This makes sure you invoke the the tool without the plugin. ## Step 4: Edit the executable definition The last thing the plugin is responsible for is to define the CLI or executable that you'd like 1Password to handle authentication for. This is the final piece that glues everything together. The executable definition describes the following: * The **command** that should get executed by the 1Password CLI. * The display **name** of the CLI, as the platform calls it. * The **documentation URL** provided by the platform that describes the executable. *(optional)* * When the executable **needs authentication**. For example, many CLIs don't require authentication when the `--help` or `--version` flags are present. * The **credentials** that the executable uses. ### Executable Examples * [AWS CLI](https://github.com/1Password/shell-plugins/blob/main/plugins/aws/aws.go) (`aws`) * [GitHub CLI](https://github.com/1Password/shell-plugins/blob/main/plugins/github/gh.go) (`gh`) * [Heroku CLI](https://github.com/1Password/shell-plugins/blob/main/plugins/heroku/heroku.go) (`heroku`) ## Step 5: Build and test your plugin locally To see if you've properly filled out the plugin, credential, and executable defintions, you can run the following Makefile command to validate the definitions: ``` make /validate ``` If that succeeds, it's now time to locally build and test your plugin! You can do so using the following command: ``` make /build ``` The build artifact will be placed in `~/.op/plugins/local`. It should show up in `op` if you run the following command: ```shell theme={null} op plugin list ``` To see it in action, you can use the `op plugin init` command: ```shell theme={null} op plugin init ``` ## Submit a PR While you're free to keep on using the plugin locally, we'd encourage you to submit a PR on the [main registry on GitHub](https://github.com/1Password/shell-plugins) so others can use it too! Before doing so, be sure to read the [CONTRIBUTING.md](https://github.com/1Password/shell-plugins/blob/main/CONTRIBUTING.md) file on GitHub. If you feel that the SDK does not serve your use case well, reach out to us by creating an [issue on GitHub](https://github.com/1Password/shell-plugins/issues) or by joining our [Developer Slack workspace](/joinslack) to tell us about your plugin proposal. We can advise you on the most suitable approach for your use case. ## Learn more * [Shell plugins troubleshooting](/cli/shell-plugins/troubleshooting/) * [Join our Developer Slack workspace](/joinslack) # Use 1Password to securely authenticate Crowdin CLI Source: https://www.1password.dev/cli/shell-plugins/crowdin The Crowdin CLI shell plugin allows you to use 1Password to securely authenticate [Crowdin CLI ](https://crowdin.github.io/crowdin-cli/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate Crowdin CLI with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.22.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Connect 1Password CLI with the 1Password app](/cli/app-integration/). 5. [Install Crowdin CLI. ](https://crowdin.github.io/crowdin-cli/) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | ------------------------ | | Token | `CROWDIN_PERSONAL_TOKEN` | | Project ID | `CROWDIN_PROJECT_ID` | | Host Address | `CROWDIN_BASE_URL` | *Thanks to [@JoeKarow](https://github.com/JoeKarow) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/359)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute).* # Use 1Password to securely authenticate Databricks CLI Source: https://www.1password.dev/cli/shell-plugins/databricks The Databricks shell plugin allows you to use 1Password to securely authenticate [Databricks CLI ](https://docs.databricks.com/dev-tools/cli/index.html) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate Databricks CLI with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.13.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. Install [Databricks CLI. ](https://docs.databricks.com/dev-tools/cli/index.html) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | Host | `DATABRICKS_HOST` | | Token | `DATABRICKS_TOKEN` | *Thanks to [@bsamseth](https://github.com/bsamseth) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/143)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute/).*

Learn more

# Use 1Password to securely authenticate Dogshell Source: https://www.1password.dev/cli/shell-plugins/datadog The Dogshell shell plugin allows you to use 1Password to securely authenticate [Dogshell ](https://docs.datadoghq.com/developers/guide/dogshell-quickly-use-datadog-s-api-from-terminal-shell/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate Dogshell with biometrics.

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field names | Environment variable | | --------------------- | -------------------- | | API Key | `DATADOG_API_KEY` | | App Key | `DATADOG_APP_KEY` |

Learn more

# Use 1Password to securely authenticate the DigitalOcean CLI Source: https://www.1password.dev/cli/shell-plugins/digitalocean The DigitalOcean shell plugin allows you to use 1Password to securely authenticate [doctl ](https://docs.digitalocean.com/reference/doctl/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate doctl with biometrics.

1. Open and unlock [1Password in your browser](https://support.1password.com/getting-started-browser/). 2. [Follow the steps](https://docs.digitalocean.com/reference/api/create-personal-access-token/) to create a DigitalOcean personal access token. 3. Select **Save item** when 1Password asks if you want to save an item for the DigitalOcean personal access token. 4. Choose the vault where you want to save the item, edit the item's name and details, then select **Save item**.

The prompt to save your DigitalOcean personal access token in 1Password.

## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | --------------------------- | | Token | `DIGITALOCEAN_ACCESS_TOKEN` |

Learn more

# Use 1Password to securely authenticate AWS Eksctl Source: https://www.1password.dev/cli/shell-plugins/eksctl The `eksctl` shell plugin allows you to use 1Password to securely authenticate [`eksctl` ](https://eksctl.io/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate `eksctl` with biometrics. You can also set up the [AWS CLI shell plugin](/cli/shell-plugins/aws/) or the [AWS CDK Toolkit shell plugin](/cli/shell-plugins/aws-cdk-toolkit/). ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.17.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. [Install `eksctl` ](https://docs.aws.amazon.com/eks/latest/eksctl/installation.html). The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials eksctl} /> ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI eksctl} /> ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help eksctl} /> ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field names | Environment variables | | --------------------- | ----------------------- | | Access Key ID | `AWS_ACCESS_KEY_ID` | | Secret Access Key | `AWS_SECRET_ACCESS_KEY` |

Learn more

*Thanks to [@skpaz](https://github.com/skpaz) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/500)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute).* # Use shell plugins to switch between multiple environments Source: https://www.1password.dev/cli/shell-plugins/environments You can use [1Password Shell Plugins](/cli/shell-plugins/) to seamlessly switch between different sets of credentials for different environments, so you don't have to spend time signing in or out between environments. For example, you can set the Terraform shell plugin to use your development credentials in the working directory for your development environment and your production credentials in the working directory for your production environment. Then when you run a Terraform command in either directory, the Terraform plugin will automatically authenticate with the appropriate credentials. ## Step 1: Organize your directories by environment Before you configure a shell plugin for context switching between environments, group the directories you want to use with the plugin by environment. For example, if you wanted to use the Terraform shell plugin in both development and production environments, you would organize your directories like this: ``` projects/ ├─ development/ │ ├─ dev-project-1 │ ├─ dev-project-2 ├─ production/ │ ├─ prod-project-1 │ ├─ prod-project-2 ``` ## Step 2: Configure default credentials for each environment After you organize your directories by environment, you can set default credentials for your shell plugin to use in each directory and all its subfolders. 1. Change directories to one of the environment-level folders you created. For example: ```shell theme={null} cd projects/production ``` 2. Sign in to the 1Password account where the credentials you want to use are stored: ```shell theme={null} op signin ``` 3. Choose a plugin to initialize, or run `op plugin init` to choose from a list of all available plugins. For example, to initialize the Terraform shell plugin: ```shell theme={null} op plugin init terraform ``` 4. Import or select the appropriate credentials for the environment. 5. Select **Use automatically when in this directory or subdirectories** as the default credential scope. 6. Repeat the process in other environment-level folders with their respective credentials. This will make the credentials you configure in each environment-level folder the default for all subfolders within it, as long as no other directory-specific defaults are set in them. ## Step 3: Use the plugin in multiple environments After you set default credentials in all your environment-level folders, you can use the shell plugin in the working directories for each environment without needing to sign in or out. 1. Enter the working directory for an environment. For example, to change directories into the development environment from the example above: ```shell theme={null} cd ~/projects/development ``` 2. Run a job in that environment. For example: ```shell theme={null} terraform apply ``` 3. Switch to a different environment. For example, to change to the production environment: ```shell theme={null} cd ~/projects/production ``` 4. Run a job in that environment: ```shell theme={null} terraform apply ``` 5. Exit the environment: ```shell theme={null} op signout ``` The shell plugin will automatically authenticate with the appropriate credentials for each environment, without requiring any action on your part. ## Learn more * [Get started with 1Password Shell Plugins](/cli/shell-plugins/) * [Build your own shell plugins](/cli/shell-plugins/contribute/) # Use 1Password to securely authenticate Fastly CLI Source: https://www.1password.dev/cli/shell-plugins/fastly The Fastly shell plugin allows you to use 1Password to securely authenticate [Fastly CLI ](https://developer.fastly.com/reference/cli/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate Fastly CLI with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.14.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. Install [Fastly CLI. ](https://developer.fastly.com/learning/tools/cli) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | Token | `FASTLY_API_TOKEN` | *Thanks to [@arunsathiya](https://github.com/arunsathiya) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/169)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute/).*

Learn more

# Use 1Password to securely authenticate Flyctl Source: https://www.1password.dev/cli/shell-plugins/flyctl The Flyctl shell plugin allows you to use 1Password to securely authenticate [Flyctl ](https://fly.io/docs/hands-on/install-flyctl/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate Flyctl with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.22.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Connect 1Password CLI with the 1Password app](/cli/app-integration/). 5. [Install Flyctl. ](https://fly.io/docs/hands-on/install-flyctl/) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | Token | `FLY_ACCESS_TOKEN` | *Thanks to [@arunsathiya](https://github.com/arunsathiya) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/141)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute).* # Use 1Password to securely authenticate FOSSA CLI Source: https://www.1password.dev/cli/shell-plugins/fossa The FOSSA shell plugin allows you to use 1Password to securely authenticate [FOSSA CLI ](https://github.com/fossas/fossa-cli) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate FOSSA CLI with biometrics.

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | API Key | `FOSSA_API_KEY` |

Learn more

# Use 1Password to securely authenticate the Gitea CLI Source: https://www.1password.dev/cli/shell-plugins/gitea The Gitea shell plugin allows you to use 1Password to securely authenticate [the Gitea CLI ](https://gitea.com/gitea/tea) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate Gitea with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.16.1 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. [Install the Gitea CLI ](https://gitea.com/gitea/tea). The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

```shell theme={null} rm ~/.config/tea/config.yml ``` ## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference 1Password authenticates with Gitea by injecting a temporary file with the credentials required by the plugin commands directly from your 1Password account. If you saved your Gitea credentials in 1Password manually rather than using `op plugin` to import a new item, make sure that your field names match the table below. If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields. | 1Password field name | YAML config field | | -------------------- | ----------------- | | Token | `token` | | HostAddress | `name`, `url` | | User | `user` |

Learn more

# Use 1Password to securely authenticate the GitHub CLI Source: https://www.1password.dev/cli/shell-plugins/github The GitHub shell plugin allows you to use 1Password to securely authenticate [the GitHub CLI ](https://cli.github.com/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate the GitHub CLI with biometrics.

## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.9.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. Install [the GitHub CLI ](https://github.com/cli/cli#installation). The following shells are supported: * Bash * Zsh * fish ## Before you begin: Create and save a GitHub personal access token Before you can use 1Password to authenticate the GitHub CLI, you'll need to [create a GitHub personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token). 1Password authenticates the GitHub CLI with your personal access token instead of a username and password. If you've already created a personal access token, [skip to Step 1](#step-1-configure-your-default-credentials). If you haven't created a personal access token yet, you can create one and use the [1Password browser extension](https://support.1password.com/getting-started-browser/) to quickly save it in 1Password:

1. Open and unlock [1Password in your browser](https://support.1password.com/getting-started-browser/). 2. [Follow the steps](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) to create a GitHub personal access token. 3. Select **Save item** when 1Password asks if you want to save an item for the GitHub personal access token. 4. Choose the vault where you want to save the item, edit the item's name and details, then select **Save item**.

The pop-up screen to save your GitHub personal access token in 1Password.

## Step 1: Configure your default credentials **If you use multiple GitHub accounts** If you want to use the GitHub shell plugin with more than one GitHub account, like your personal and work accounts, [learn how to set up your plugin to use multiple accounts](/cli/shell-plugins/multiple-accounts/). If you use a single GitHub account, select **Use as global default on my system**. This will set your personal access token as the default in all terminal sessions and directories. If you use multiple GitHub accounts, [learn how to use directory-specific defaults for context switching](/cli/shell-plugins/multiple-accounts/). ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk After saving your GitHub credentials in 1Password, you can remove all local copies you previously had stored on disk. ```shell theme={null} rm ~/.config/gh/hosts.yml ``` ## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field names | Environment variables | | --------------------- | --------------------- | | Token | `GH_TOKEN` | | Host (optional) | `GH_HOST` |

Learn more

# Use 1Password to securely authenticate the GitLab CLI Source: https://www.1password.dev/cli/shell-plugins/gitlab The GitLab shell plugin allows you to use 1Password to securely authenticate [the GitLab CLI ](https://docs.gitlab.com/ee/integration/glab/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate the GitLab CLI with biometrics.

## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.9.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Integrate 1Password CLI with the 1Password app](/cli/get-started/#step-2-turn-on-the-1password-desktop-app-integration). 5. Install [the GitLab CLI. ](https://gitlab.com/gitlab-org/cli/-/blob/main/README.md#installation) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Optional: If you use a self-hosted instance, set the host If you use a self-hosted GitLab instance, you'll need to add your host URL to the GitLab item you configured in the previous step. Save the URL in a custom text field titled `Host` to make it available to the shell plugin. To add the field using 1Password CLI: To add the field using the 1Password desktop app: 1. Open and unlock the [1Password app](https://1password.com/downloads/). 2. Navigate to the item you configured in the previous step and select **Edit**. 3. Select **Add More** > **Text** to add a custom text field. 4. Select the default field name, "text", and rename it to `Host`. 5. Enter your GitLab host as the field value. For example, `https://gitlab.yourdomain.com` 6. Select **Save**. ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field names | Environment variables | | --------------------------------------------------- | --------------------- | | Token | `GITLAB_TOKEN` | | Host (optional; required for self-hosted instances) | `GITLAB_HOST` | | API Host (optional) | `GITLAB_API_HOST` |

Learn more

# Use 1Password to securely authenticate the HashiCorp Vault CLI Source: https://www.1password.dev/cli/shell-plugins/hashicorp-vault The HashiCorp Vault shell plugin allows you to use 1Password to securely authenticate [the Vault CLI ](https://developer.hashicorp.com/vault/docs/commands) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate the Vault CLI with biometrics.

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field names | Environment variables | | --------------------- | --------------------- | | Token | `VAULT_TOKEN` | | Address (optional) | `VAULT_ADDR` | | Namespace (optional) | `VAULT_NAMESPACE` |

Learn more

# Use 1Password to securely authenticate the Heroku CLI Source: https://www.1password.dev/cli/shell-plugins/heroku The Heroku shell plugin allows you to use 1Password to securely authenticate [the Heroku CLI ](https://devcenter.heroku.com/articles/heroku-cli) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate the Heroku CLI with biometrics.

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | API Key | `HEROKU_API_KEY` |

Learn more

# Use 1Password to securely authenticate the Hetzner Cloud CLI Source: https://www.1password.dev/cli/shell-plugins/hetzner-cloud The Hetzner Cloud shell plugin allows you to use 1Password to securely authenticate [hcloud ](https://github.com/hetznercloud/cli) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate hcloud with biometrics.

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field names | Environment variable | | --------------------- | -------------------- | | Token | `HCLOUD_TOKEN` | *Thanks to [@shyim](https://github.com/shyim) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/87)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute/).*

Learn more

# Use 1Password to securely authenticate brew Source: https://www.1password.dev/cli/shell-plugins/homebrew The Homebrew shell plugin allows you to use 1Password to securely authenticate [the Homebrew package manager ](https://brew.sh/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate brew with biometrics.

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | --------------------------- | | Token | `HOMEBREW_GITHUB_API_TOKEN` | *Thanks to [@markdorison](https://github.com/markdorison) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/110)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute/).*

Learn more

# Use 1Password to securely authenticate HuggingFace CLI Source: https://www.1password.dev/cli/shell-plugins/huggingface The HuggingFace CLI shell plugin allows you to use 1Password to securely authenticate [HuggingFace CLI ](https://huggingface.co/docs/huggingface_hub/quick-start) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate HuggingFace CLI with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.22.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Connect 1Password CLI with the 1Password app](/cli/app-integration/). 5. [Install HuggingFace CLI. ](https://huggingface.co/docs/huggingface_hub/quick-start) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | ------------------------ | | User Access Token | `HUGGING_FACE_HUB_TOKEN` | | Endpoint (optional) | `HF_ENDPOINT` | | API URL (optional) | `HF_INFERENCE_ENDPOINT` | *Thanks to [@bala-ceg](https://github.com/bala-ceg) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/393)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute).* # Use 1Password to securely authenticate InfluxDB Source: https://www.1password.dev/cli/shell-plugins/influxdb The InfluxDB shell plugin allows you to use 1Password to securely authenticate [InfluxDB ](https://docs.influxdata.com/influxdb/cloud/reference/cli/influx/config/) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate InfluxDB with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.22.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Connect 1Password CLI with the 1Password app](/cli/app-integration/). 5. [Install InfluxDB. ](https://docs.influxdata.com/influxdb/cloud/reference/cli/influx/config/) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | Host | `INFLUX_HOST` | | Organization | `INFLUX_ORG` | | Access Token | `INFLUX_TOKEN` | *Thanks to [@bala-ceg](https://github.com/bala-ceg) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/392)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute).* # Use 1Password to securely authenticate Kaggle CLI Source: https://www.1password.dev/cli/shell-plugins/kaggle The Kaggle CLI shell plugin allows you to use 1Password to securely authenticate [Kaggle CLI ](https://github.com/Kaggle/kaggle-api) with your fingerprint, Apple Watch, or system authentication, rather than storing your credentials in plaintext. Follow the instructions to configure your default credentials and source the `plugins.sh` file, then you'll be prompted to authenticate Kaggle CLI with biometrics. ## Requirements 1. [Sign up for 1Password.](https://1password.com/pricing/password-manager) 2. Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac) or [Linux](https://1password.com/downloads/linux). 3. Install [1Password CLI](https://app-updates.agilebits.com/product_history/CLI2) 2.22.0 or later.
If you've already installed 1Password CLI, learn how to update your installation. 4. [Connect 1Password CLI with the 1Password app](/cli/app-integration/). 5. [Install Kaggle CLI. ](https://github.com/Kaggle/kaggle-api) The following shells are supported: * Bash * Zsh * fish ## Step 1: Configure your default credentials ## Step 2: Source the plugins.sh file

To make the plugin available, source your plugins.sh file. For example:

```sh theme={null} source ~/.config/op/plugins.sh ```

The file path for your op folder may vary depending on your configuration directory. op plugin init will output a source command with the correct file path.

## Step 3: Use the CLI ## Step 4: Remove imported credentials from disk

After saving your credentials in 1Password, you can remove all local copies you previously had stored on disk.

## Next steps

1Password Shell Plugins support more than 60 third-party CLIs. To see a list of supported CLIs:

To choose another plugin to get started with:

To use shell plugins for seamless context switching, learn how to configure a plugin in multiple environments or with multiple accounts.

## Get help ## Reference

1Password authenticates with by injecting environment variables with the credentials required by the plugin commands directly from your 1Password account.

If you saved your credentials in 1Password manually rather than using op plugin to import a new item, make sure that your field names match the table below.

If the item doesn't contain a field with the required name, you'll be prompted to rename one of the existing fields.

| 1Password field name | Environment variable | | -------------------- | -------------------- | | Token | `KAGGLE_KEY` | | Username | `KAGGLE_USERNAME` | *Thanks to [@rajapri28613](https://github.com/rajapri28613) for [contributing this plugin](https://github.com/1Password/shell-plugins/pull/341)! Learn how to [build your own shell plugins](/cli/shell-plugins/contribute).* # Use 1Password to securely authenticate the Lacework CLI Source: https://www.1password.dev/cli/shell-plugins/lacework The Lacework shell plugin allows you to use 1Password to securely authenticate [the Lacework CLI

Parameter	Type	Description
`title`	string	The title of the item.
`vault`	object	An object containing an `id` property whose value is the UUID of the vault the item is in.
`category`	string	The category of the item. One of: `"LOGIN"` `"PASSWORD"` `"API\_CREDENTIAL"` `"SERVER"` `"DATABASE"` `"CREDIT\_CARD"` `"MEMBERSHIP"` `"PASSPORT"` `"SOFTWARE\_LICENSE"` `"OUTDOOR\_LICENSE"` `"SECURE\_NOTE"` `"WIRELESS\_ROUTER"` `"BANK\_ACCOUNT"` `"DRIVER\_LICENSE"` `"IDENTITY"` `"REWARD\_PROGRAM"` `"EMAIL\_ACCOUNT"` `"SOCIAL\_SECURITY\_NUMBER"` `"MEDICAL\_RECORD"` `"SSH\_KEY"` You can't create items using the "CUSTOM" or "DOCUMENT" categories.
`urls`	array	Array of URL objects containing URLs for the item.
`favorite`	boolean	Mark the item as a favorite.
`tags`	string	An array of strings of the tags assigned to the item.
`fields`	array	An array of Field objects of the fields to include with the item.
`sections`	array	An array of Section objects of the sections to include with the item.

Parameter	Type	Description
`vaultUUID`	string	The UUID of the vault to retrieve the item from.
`itemUUID`	string	The UUID of the item to retrieve.

Parameter	Type	Description
`vaultUUID`	string	The UUID of the vault to retrieve the item from.
`itemUUID`	string	The UUID of the item to replace.

Parameter	Type	Description
`vaultUUID`	string	The UUID of the vault to retrieve the item from.
`itemUUID`	string	The UUID of the item to delete.

Parameter	Type	Description
`vaultUUID`	string	The UUID of the vault the item is in.
`itemUUID`	string	The UUID of the item to update.

Parameter	Type	Description
`op`	string	The kind of operation to perform. One of: `add` `remove` `replace`
`path`	string	An RFC6901 JSON Pointer to the item, an item attribute, an item field by field ID, or an item field attribute. For example: `"/fields/vy09gd8EXAMPLE/label"`
`value`	any	The new value to apply at the path.

Parameter	Type	Description
`vaultUUID`	string	The UUID of the vault to get the details of.
`itemUUID`	string	The UUID of the item to retrieve.

Parameter	Type	Description
`limit`	integer	How many API Events should be retrieved in a single request. Optional.
`offset`	integer	How far into the collection of API Events should the response start. Optional.

Parameter	Type	Description
`requestID`	string	The UUID for the request.
`timestamp`	dateTime	Date and time of the request.
`action`	string	The action taken. One of: `"READ"` `"CREATE"` `"UPDATE"` `"DELETE"`
`result`	string	The result of the action. One of: `"SUCCESS"` `"DENY"`
`actor`	object	An Actor object.
`resource`	object	A Resource object.

Parameter	Type	Description
`id`	string	The UUID of the Connect server that made the request.
`account`	string	The UUID of the 1Password account the request went to.
`jti`	string	The UUID of the access token used to authenticate the request.
`userAgent`	string	The user agent string specified in the request.
`ip`	string	The IP address the request originated from.

Parameter	Type	Description
`type`	string	The resource requested. One of: `"ITEM"` `"VAULT"`
`vault`	object	An object containing an `id` property with the value of the UUID of the vault requested.
`item`	object	An object containing an `id` property with the value of the UUID of the item requested.
`itemVersion`	integer	The version of the item.

Parameter	Type	Description
`status`	integer	The HTTP status code.
`message`	string	A message detailing the error.

Parameter	Type	Description
`id`	string	The UUID of the vault.
`name`	string	The name of the vault.
`description`	string	The description for the vault.
`attributeVersion`	integer	The version of the vault metadata.
`contentVersion`	integer	The version of the vault contents.
`items`	integer	Number of active items in the vault.
`type`	string	The type of vault. One of: `"EVERYONE"`: The team Shared vault. `"PERSONAL"`: The Private vault for the Connect server. `"USER\_CREATED"`: A vault created by a user.
`createdAt`	dateTime	Date and time when the vault was created.
`updatedAt`	dateTime	Date and time when the vault or its contents were last changed.

Parameter	Type	Description
`id`	string	The UUID of the item.
`title`	string	The title of the item.
`vault`	object	An object containing an `id` property whose value is the UUID of the vault the item is in.
`category`	string	The category of the item. One of: `"LOGIN"` `"PASSWORD"` `"API\_CREDENTIAL"` `"SERVER"` `"DATABASE"` `"CREDIT\_CARD"` `"MEMBERSHIP"` `"PASSPORT"` `"SOFTWARE\_LICENSE"` `"OUTDOOR\_LICENSE"` `"SECURE\_NOTE"` `"WIRELESS\_ROUTER"` `"BANK\_ACCOUNT"` `"DRIVER\_LICENSE"` `"IDENTITY"` `"REWARD\_PROGRAM"` `"DOCUMENT"` `"EMAIL\_ACCOUNT"` `"SOCIAL\_SECURITY\_NUMBER"` `"MEDICAL\_RECORD"` `"SSH\_KEY"` You can't create items using the "CUSTOM" or "DOCUMENT" categories.
`urls`	array	Array of URL objects containing URLs for the item.
`favorite`	boolean	Whether the item is marked as a favorite.
`tags`	array	An array of strings of the tags assigned to the item.
`version`	integer	The version of the item.
`createdAt`	dateTime	Date and time when the item was created.
`updatedAt`	dateTime	Date and time when the vault or its contents were last changed.
`lastEditedBy`	string	UUID of the account that last changed the item.

Parameter	Type	Description
`purpose` or `type`	string	Use `purpose` for the username, password, and notes fields. Possible values: `"USERNAME"` `"PASSWORD"` `"NOTES"` Use `type` for all other fields. Possible values are: `"STRING"` `"EMAIL"` `"CONCEALED"` `"URL"` `"OTP"` (format: `otpauth://`) `"DATE"` (format: `YYYY-MM-DD`) `"MONTH\_YEAR"` (format: `YYYYMM` or `YYYY/MM`) `"MENU"`
`value`	string	The value to save for the field. You can specify a `generate` field instead of `value` to create a password or other random information for the value.
`generate`	boolean	Generate a password and save in the value for the field. By default, the password is a 32-characters long, made up of letters, numbers, and symbols. To customize the password, include a `recipe` field.
`recipe`	object	A GeneratorRecipe object.
`section`	object	An object containing the UUID of a section in the item.

Name	Type	Description
`id`	string	The UUID of the file.
`name`	string	The name of the file.
`size`	integer	The size of the file in bytes.
`content\_path`	string	The path to download the contents of the file.
`content`	string	The Base64-encoded contents of the file, if `inline\_files` is set to `true`.
`section`	object	An object containing the UUID of a section in the item.

Name	Type	Description
`length`	integer	The length of the password to generate. Optional.
`characterSets`	array	An array containing of the kinds of characters to include. Optional. Possible values: `"LETTERS"` `"DIGITS"` `"SYMBOLS"`
`excludeCharacters`	string	A list of all characters that should be excluded from generated passwords. Optional.

Name	Type	Description
`entropy`	integer	The unpredictability of the password, measured in bits.
`generated`	boolean	Whether the password was generated using the password generator.
`strength`	string	The strength of the password. One of: `"TERRIBLE"` `"WEAK"` `"FAIR"` `"GOOD"` `"VERY\_GOOD"` `"EXCELLENT"` `"FANTASTIC"`
`history`	array	An array of strings containing the previous passwords of the item.

Name	Type	Description
`id`	string	A unique identifier for the section.
`label`	string	The label for the section.

Name	Type	Description
`label`	string	The label for the URL.
`primary`	boolean	Whether this is the primary URL for the item.
`href`	string	The address.

Name	Type	Description
`name`	string	Name of the server
`version`	string	Version info of the Connect server
`dependencies`	array	An array of Service Dependencies.

Name	Type	Description
`service`	string	Name of the dependency
`status`	string	The service's reported status
`message`	string	Extra information about the dependency's status. Optional.

Event	Description	Action	Object Type	Aux Info
Activate Account	The account was activated.	`activate`	`account`
Update Account	Account attributes, such as the name, were changed.	`update`	`account`
Delete Account	The account was deleted.	`delete`	`account`
Update Account Domain	The account domain was changed.	`update`	`account`	domain
Change Account Type	The account type was changed.	`convert`	`account`	old account type, new account type `I`: Individual account `F`: Family account `B`: Business account
Enable Duo	Duo was enabled for the account.	`enblduo`	`account`
Update Duo Configuration	The Duo configuration for the account was updated.	`updatduo`	`account`
Disable Duo	Duo was disabled for the account.	`disblduo`	`account`

Event	Description	Action	Object Type	Aux Info
Add Device	A device was added to the account.	`create`	`device`	user ID, user UUID, user name, user email
Update Device	A device was updated.	`update`	`device`	user ID, user UUID, user name, user email
Delete Device	A device was deleted.	`delete`	`device`	user ID, user UUID, user name, user email
Delete Old Devices	Old devices were deleted.	`deolddev`	`user`
Delete All Devices	All devices were deleted.	`dealldev`	`user`
Reauthorize Device	A device was reauthorized after being deauthorized	`reauth`	`device`	user ID, user UUID, user name, user email

Event	Description	Action	Object Type
Begin Email Change	An email change was requested by a user.	`begin`	`ec`
Complete Email Change	A user's email was changed.	`complete`	`ec`
Propose Email Change	An email change was proposed by an admin.	`propose`	`ec`

Load secrets with the `exec` command

Load secrets with the `export` command

Use secrets from the action's output

Step 1: Install the 1Password Secrets plugin for Jenkins

Step 3: Configure the 1Password Secrets plugin for Jenkins

Step 1: Map secret references to environment variables

Step 2: Pass the resolved secret references to the application

Learn more

Learn more

Save your one-time password and ARN in 1Password

Step 1: Save your QR code

Step 2: Save the ARN for your multi-factor authentication device

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Learn more

Step 1.1: Import or select an item

Step 1.2: Set default credential scope

Inspect your configuration

Clear your credentials

Learn more

Learn more

Learn more

If you can't find your plugins.sh file

Learn more

Learn more

Learn more

Appendix: Item JSON template

Eliminate plaintext secrets in code

Learn more

Automate administrative tasks

Learn more

Learn more

Avoid using environment variables for sensitive information

Avoid using environment variables for sensitive information

Step 1: Create a Secrets Automation workflow

Step 2: Deploy a 1Password Connect Server

Deploy alongside the Kubernetes Operator

Use your own certificate

Use Let's Encrypt

Get an Environment's ID

Read Environments with 1Password SDKs

Read Environments with 1Password CLI

User WebAuthn credentials (passkeys)

Query parameters

Step 2. Install the Kubernetes Operator using Helm

Event	Description	Action	Object Type	Aux Info
Add Family Member Account	A team member linked their free family account.	`rdmchild`	`famchild`
Remove Family Member Account	A team member unlinked their free family account.	`detchild`	`famchild`

Event	Description	Action	Object Type	Aux Info
Create Group	A group was created.	`create`	`group`	group name Available for events that occurred after June 11, 2025.
Delete Group	A group was deleted.	`delete`	`group`	group name
Update Group	A group was updated.	`update`	`group`	group name
Purge Deleted Group	A group was marked to be purged.	`purge`	`group`
Update Group Keyset	A group keyset was replaced.	`changeks`	`group`

Event	Description	Action	Object Type	Aux Info
Join Group	A user joined a group.	`join`	`gm`	user ID, user UUID, user name, user email, user role `R`: Group member `A`: Group manager
Leave Group	A user left a group.	`leave`	`gm`	user ID, user UUID, user name, user email
Change Group Membership Role	A user's group membership role was changed.	`role`	`gm`	user ID, user UUID, user name, user email, user role `R`: Group member `A`: Group manager

Event	Description	Action	Object Type	Aux Info
Grant Group Vault Access	A group was granted access to a vault.	`grant`	`gva`	group ID, group UUID, Access Control List
Revoke Group Vault Access	A group's access to a vault was revoked.	`revoke`	`gva`	group ID, group UUID
Update Group Vault Access	A group's vault access was updated.	`update`	`gva`	group ID, group UUID, Access Control List

Event	Description	Action	ObjectType	AuxInfo
Create Invite	An invite was created.	`create`	`invite`	The email address the invite was sent to.
Update Invite	An invite was updated.	`update`	`invite`	The email address the invite was sent to.

Event	Description	Action	ObjectType	AuxInfo
Patch Vault Items	Vault items were added or updated.	`patch`	`items`	Vault Content Version, number of items added or updated.
Delete Trashed Vault Items	Vault items in the trash were deleted.	`delete`	`items`	Vault Content Version, number of items deleted.
Purge Deleted Vault Items	Deleted vault items were marked to be purged.	`purge`	`items`	Number of items that were marked to be purged.
Purge Vault Item History	Archived vault items were marked to be purged.	`purge`	`itemhist`	item ID, item UUID

Event	Description	Action	Object Type	Aux Info
Share Item	An item was shared externally.	`share`	`item`	vault ID, vault UUID, shared item UUID
Delete Item Share	A shared item link was deleted.	`delshare`	`item`	vault ID, vault UUID, shared item UUID
Update Item Share Settings	The account's item sharing settings were updated.	`uisas`	`account`

Event	Description	Action	Object Type	Aux Info
Add Managed Company	A managed company was added to an MSP account.	`create`	`mngdacc`
Launch Into Managed Company	An MSP technician launched into a managed company.	`launchi`	`mngdacc`	The ID and UUID of the launched session.
Unlink Managed Company	A managed company was unlinked from an MSP account.	`unlink`	`mngdacc`

Event	Description	Action	Object Type	Aux Info
Enable Multi-Factor Authentication	Multi-factor authentication was enabled.	`enblmfa`	`user`	multi-factor authentication ID, multi-factor authentication type
Update Multi-Factor Authentication	Multi-factor authentication was updated.	`updatmfa`	`user`	multi-factor authentication ID, multi-factor authentication type
Disable Multi-Factor Authentication	Multi-factor authentication was disabled.	`disblmfa`	`user`	multi-factor authentication ID, multi-factor authentication type
Disable Multi-Factor Authentication For All Users	Multi-factor authentication was disabled for everyone in the account.	`disblmfa`	`account`
Disable Multi-Factor Authentication Type For All Users	Multi-factor authentication of a certain type was disabled for everyone in the account.	`disblmfa`	`account`	multi-factor authentication type

Event	Description	Action	Object Type
Send Provisioning Email	A provisioning email was sent.	`sendts`	`user`
Resend Provisioning Email	A provisioning email was resent.	`resendts`	`user`
Resend All Provisioning Emails	All provisioning emails were resent.	`prsndall`	`invite`