1password

# 1Password Secret Management Securely store and retrieve secrets. Never expose them in chat, logs, or files. ## Prerequisites - `op` CLI installed: `brew install --cask 1password-cli` - Signed in: `op signin` (or service account via `OP_SERVICE_ACCOUNT_TOKEN`) - For biometric unlock: enable in 1Password desktop app → Settings → Developer → CLI integration ## Core Commands ### Read a secret ```bash op read "op://VaultName/ItemName/FieldName" ``` ### List vaults ```bash op vault list --format json | jq '.[].name' ``` ### List items in a vault ```bash op item list --vault "Development" --format json | jq '.[].title' ``` ### Create an item ```bash op item create \ --category login \ --vault "Development" \ --title "Service API Key" \ --field "credential=secret_value_here" ``` ### Search items ```bash op item list --format json | jq '.[] | select(.title | test("github"; "i"))' ``` ## Environment Files (Secret References) Create env files with `op://` references — secrets are resolved at runtime, never stored on disk. ### Setup for ask-curl ```bash mkdir -p ~/.config/ask-curl # Create env file with secret references (NOT actual secrets) cat > ~/.config/ask-curl/env.curl << 'ENV' GITHUB_TOKEN=op://Development/GitHub PAT/credential OPENAI_API_KEY=op://Development/OpenAI/api key SLACK_WEBHOOK=op://Development/Slack Webhook/url ENV ``` ### Use with `op run` ```bash # Inject secrets from env file into a command op run --env-file=~/.config/ask-curl/env.curl ...