> ## Documentation Index
> Fetch the complete documentation index at: https://www.1password.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Use service accounts with 1Password CLI

export const Small = ({children}) => {
  return <small>{children}</small>;
};

You can use 1Password Service Accounts with 1Password CLI to manage vaults and items. See [supported commands](#supported-commands).

## Requirements

Before you use service accounts with 1Password CLI, you need to:

* [Sign up for 1Password.](https://1password.com/pricing/password-manager)
* Install [1Password CLI](/cli/get-started/).
  <br /><Small> Service Accounts require 1Password CLI version 2.18.0 or later.</Small>
* [Create a service account.](/service-accounts/get-started/#create-a-service-account)

## Get started

To use a service account with 1Password CLI:

1. Set the `OP_SERVICE_ACCOUNT_TOKEN` environment variable to the service account token:

   <Tabs groupId="operating-systems">
     <Tab title="bash, sh, zsh">
       ```shell theme={null}
       export OP_SERVICE_ACCOUNT_TOKEN=<your-service-account-token>
       ```
     </Tab>

     <Tab title="fish">
       ```shell theme={null}
       set -x OP_SERVICE_ACCOUNT_TOKEN <your-service-account-token>
       ```
     </Tab>

     <Tab title="Powershell">
       ```shell theme={null}
       $Env:OP_SERVICE_ACCOUNT_TOKEN = "<your-service-account-token>"
       ```
     </Tab>
   </Tabs>

2. Run the following command to make sure the service account is configured:

   ```shell highlight={9} theme={null}
   op user get --me

   # code-result

   ID:                     <service-account-id>
   Name:                   <service-account-name>
   Email:                  <service-account-email>
   State:                  ACTIVE
   Type:                   SERVICE_ACCOUNT
   Created:                2 minutes ago
   Updated:                2 minutes ago
   Last Authentication:    now

   ```

<Warning>
  If you have 1Password CLI configured to work with [1Password Connect](/connect/), the <code>OP\_CONNECT\_HOST</code> and <code>OP\_CONNECT\_TOKEN</code> environment variables take precedence over <code>OP\_SERVICE\_ACCOUNT\_TOKEN</code>.

  Clear the Connect environment variables to configure a service account instead.
</Warning>

### Supported commands

You can now run supported 1Password CLI commands authenticated as the service account:

<CardGroup cols={2}>
  <div>
    * [`op read`](/cli/reference/commands/read/)
    * [`op inject`](/cli/reference/commands/inject/)
    * [`op service-account ratelimit`](/cli/reference/management-commands/service-account/#service-account-ratelimit)
  </div>

  <div>
    * [`op run`](/cli/reference/commands/run/)
    * [`op vault create`](/cli/reference/management-commands/vault/#vault-create)
  </div>
</CardGroup>

To use the following commands, you must specify a vault with the `--vault` flag if the service account has access to more than one vault:

<CardGroup cols={2}>
  <div>
    * [`op item`](/cli/reference/management-commands/item/)
  </div>

  <div>
    * [`op document`](/cli/reference/management-commands/document/)
  </div>
</CardGroup>

The following commands are only supported for vaults created by the service account:

<CardGroup cols={2}>
  <div>
    * [`op vault delete`](/cli/reference/management-commands/vault/#vault-delete)
    * [`op vault group grant`](/cli/reference/management-commands/vault/#vault-group-grant)
    * [`op vault user grant`](/cli/reference/management-commands/vault/#vault-user-grant)
  </div>

  <div>
    * [`op vault group revoke`](/cli/reference/management-commands/vault/#vault-group-revoke)
    * [`op vault user revoke`](/cli/reference/management-commands/vault/#vault-user-revoke)
  </div>
</CardGroup>

<Accordion title="Unsupported commands">
  When using a service account, the following commands aren't supported:

  <CardGroup cols={2}>
    <div>
      * [`op connect`](/cli/reference/management-commands/connect)
      * [`op group`](/cli/reference/management-commands/group/)
      * [`op user provision`](/cli/reference/management-commands/user/#user-provision)
      * [`op user confirm`](/cli/reference/management-commands/user/#user-confirm)
      * [`op user suspend`](/cli/reference/management-commands/user/#user-suspend)
      * [`op user delete`](/cli/reference/management-commands/user/#user-delete)
      * [`op user recovery`](/cli/reference/management-commands/user/#user-recovery)
    </div>

    <div>
      * [`op events-api`](/cli/reference/management-commands/events-api/)
      * [`op vault edit`](/cli/reference/management-commands/vault/#vault-edit)
    </div>
  </CardGroup>

  Although service accounts support some user, group, and vault management commands, we recommend against using them because a full provisioning workflow isn't supported:

  <CardGroup cols={2}>
    <div>
      * [`op user get`](/cli/reference/management-commands/user/#user-get)
      * [`op user list`](/cli/reference/management-commands/user/#user-list)
    </div>

    <div>
      * [`op group get`](/cli/reference/management-commands/group/#group-get)
      * [`op group list`](/cli/reference/management-commands/group/#group-list)
    </div>
  </CardGroup>
</Accordion>

### Commands that make multiple requests

Service accounts have [hourly and daily limits](/service-accounts/rate-limits) on the total number of requests the service account can make.

You can sometimes reduce the number of requests made by passing a vault or item's [unique identifier (ID)](/cli/reference/#unique-identifiers-ids) instead of its name.

1Password CLI commands make one request unless otherwise noted. The following commands make more than one request:

| Command           | Total requests                                    | Notes                                                                                                                                      |
| ----------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| `op item list`    | 1 + 1 per vault the service account has access to | To limit total requests to 3, list items in a specific vault using the `--vault` flag. Pass the vault's ID to further limit requests to 2. |
| `op item get`     | 3 reads                                           | To reduce to 1 request, pass the item and vault IDs.                                                                                       |
| `op item create`  | 1 read and 1 write                                | To reduce to 1 request, pass the vault ID.                                                                                                 |
| `op item delete`  | 5 reads and 1 write                               | To reduce the read requests by 1, pass the vault ID.                                                                                       |
| `op item edit`    | 5 reads and 1 write                               | To reduce the read requests by 1, pass the vault ID.                                                                                       |
| `op read`         | 3 reads                                           | To reduce to 1 request, pass the item and vault IDs.                                                                                       |
| `op vault delete` | 2 reads + 1 write                                 | To reduce the read requests by 1, pass the vault ID.                                                                                       |
| `op vault edit`   | up to 3 writes                                    | The number of requests may vary depending on how many changes are made with a single command.                                              |
| `op vault get`    | 2 reads                                           | To reduce the read requests by 1, pass the vault ID.                                                                                       |