1Password CLI is a command-line tool that reads secrets from a 1Password account and injects them into scripts, environment variables, and configuration files at runtime, so no plaintext credential has to be stored on disk.
1Password CLI is a command-line interface, invoked as op, that pulls credentials out of a 1Password account and feeds them to scripts, applications, and configuration files when they run. Instead of pasting an API key into a shell profile or an environment file, you write a secret reference that names the vault, item, and field, then let the tool resolve it at the moment it is needed. The resolved value exists only for the duration of the process, so nothing sensitive is left behind in a repository or a build log. Administrative commands cover items, vaults, users, and groups as well, which makes the same binary useful for both daily development work and account automation.
The three commands that do the heavy lifting are read, run, and inject. Read prints a single value to standard output or writes it to a file; run resolves every reference it finds in the environment and in an environment file, then executes your command with those values available as variables, masking them in the output unless you ask otherwise; inject rewrites a template file so a configuration that uses references becomes a real file on disk. Templates and environment files that contain only references are safe to commit, so they can be shared like any other file. Backups are easier for the same reason: a folder holding configuration rather than credentials can be copied freely, and SyncBackSE covers that job.
The benefit of 1Password CLI is that secrets stop living where they should not. The old pattern put credentials in shell profiles, in environment files, or in a CI system's settings, where they spread quietly across machines and outlive the project that needed them. With references resolved at runtime, the files that get committed and shared hold nothing worth stealing, and revoking access happens in one place instead of on every machine. Automation benefits as much as individuals, because a service account can authenticate a script without a human typing a password, which is what makes the tool practical in pipelines and scheduled jobs. Day-to-day commands let you list vaults, read a specific field, or create an item without opening an application, and shell plugins replace the long-lived access keys that command-line tools normally keep on disk. The result is fewer copies of the same credential and a much shorter list of places to look when one has to be rotated.
Key capabilities and highlights.
A secret reference in 1Password CLI names where a value lives, such as a vault, item, section, and field, and stands in for the credential itself in code and configuration. Because the file holds a pointer rather than a password, it can be committed to version control and reviewed like anything else.
The run command in 1Password CLI scans the environment and any environment file for references, resolves them, and starts your program with the values available as variables for that subprocess only. Output is masked by default, so a stray print statement does not spill a token into a log.
A template file containing references can be rewritten into a finished configuration file on demand, either through standard input and output or with explicit input and output paths. That suits setups where an application insists on reading a real file rather than an environment variable.
The read command returns a single secret to the terminal or to a file, and query parameters can pull specific attributes such as a one-time password or a file attachment's metadata. An SSH key can be requested in the OpenSSH format, which is handy in scripts that need a private key briefly.
Beyond reading secrets, 1Password CLI exposes create, read, update, and delete operations for items, vaults, documents, users, and groups, so account administration does not require a browser. Output can be requested as JSON for parsing with jq, and stable object identifiers make repeated commands faster.
A service account authenticates with a token instead of an interactive sign-in, which lets scripts, scheduled jobs, and pipelines fetch secrets without a person present. Access is scoped to selected vaults, so an automation account sees only what the job actually needs.
Shell plugins let common command-line tools authenticate through items stored in the vault instead of credentials saved in a configuration folder. The plugin handles the sign-in flow on demand, so the long-lived access keys those tools normally keep on disk can be removed entirely.
Wired to the desktop application, 1Password CLI triggers a system authentication prompt for any command that needs credentials, so an approved unlock can authorize a request without a master password being typed into a terminal. Signing out is a single command, and shell completion fills in subcommands and flags as you type.
Browse historical releases and previous builds.
Common questions about 1Password CLI.
It brings vault data into the terminal. You use it to inject secrets into scripts, environment variables, and configuration files at runtime, and to manage items, vaults, and account members from the command line. It is aimed at developers and administrators who want to stop storing credentials in plaintext.
It uses secret references, short URIs that point at a vault, item, and field rather than containing the value. The reference sits in your code or configuration, and the real secret is fetched only when the command runs, so the committed file contains nothing sensitive.
Read returns one value to the terminal or a file. Run resolves references in the environment and executes a command with those values as variables for that process only. Inject rewrites a template so a configuration file that contained references becomes a real file with resolved values.
Yes, through a service account, which authenticates with a token rather than an interactive sign-in. Access is limited to the vaults the service account is granted, so a pipeline or a scheduled job can retrieve only the secrets it is meant to use.
The desktop application integration is what allows an approved unlock, such as a biometric or system authentication prompt, to authorize commands. Depending on the environment, authentication can also be handled through other supported sign-in methods, including a service account for unattended use.
Yes. Commands cover items, vaults, documents, users, and groups, including creating, retrieving, updating, and deleting them. Output can be requested as JSON, which makes it straightforward to script reports or bulk changes and parse the result with a tool such as jq.
Shell plugins let other command-line tools authenticate through 1Password instead of storing their own credentials on disk. The plugin prompts for the sign-in when needed, so access keys that would otherwise live in a configuration folder can be deleted. Both are ways 1Password CLI keeps long-lived credentials out of your environment.
1Password CLI is a command-line tool that reads secrets from a 1Password account and injects them into scripts, environment variables, and configuration files at runtime, so no plaintext credential has to be stored on disk.
Proton Pass is an end-to-end encrypted password manager that stores logins, passkeys, and card details in synced vaults, generates email aliases to hide a real address, and fills credentials automatically in browsers and apps.
NordPass is a zero-knowledge password manager that stores logins, passkeys, cards, and notes in an encrypted vault, autofills them across devices, and adds password health checks, breach monitoring, and secure sharing of individual items.
Remote Desktop Manager centralizes every remote session an IT team opens, storing connections and credentials in one workspace so RDP, SSH, VNC, VPN, and web consoles launch from a single searchable list with access controls and audit trails attached.
Bitwarden is an open-source password manager for storing, generating, organizing, and synchronizing encrypted logins, passkeys, cards, identities, secure notes, and other sensitive records across supported devices.
Comments