1password

Sign in to a 1Password account

$ op signin

$ op item list --vault [vault_name]

$ op item get "[item_name]"

$ op item get "[item_name]" --fields label=username,label=password

$ op read "op://[vault]/[item]/[field]"

$ op run --env-file [.env] -- [command]

$ op item create --category login --title "[title]" --vault [vault_name]

$ op vault list

op [command] [subcommand] [flags]

op is the official command-line interface for 1Password, a password manager and secrets management platform. It enables secure access to passwords, credentials, and sensitive data directly from the terminal.
The CLI follows a noun-verb command structure where the first argument is typically a resource type (item, vault, user) followed by an action (get, list, create). It supports both interactive and scripted workflows, making it suitable for development automation and CI/CD pipelines.
Key capabilities include retrieving credentials using secret references in the format op://vault/item/field, injecting secrets into environment variables for running processes, and managing vault contents programmatically. The tool uses daemon-based caching on Unix systems to improve performance and reduce API calls.
Items can be referenced by name or by their 26-character alphanumeric ID, with IDs being more stable and efficient for automation. Output can be formatted as JSON for integration with tools like jq.

account

Manage locally configured 1Password accounts

Perform CRUD operations on vault items (get, list, create, edit, delete)

Manage vaults and their permissions

Manage document-type items (get, list, create, edit, delete)

Resolve and retrieve secret references

Pass secrets as environment variables to a subprocess

Insert secrets into configuration files or templates

Authenticate to a 1Password account

End the current session

Display information about the signed-in account

Generate shell completion scripts

Output results in JSON format for parsing with tools like jq

Specify particular fields to retrieve from an item

Target a specific vault for the operation

Disable daemon caching (useful in restricted environments)

Requires a 1Password account and must be authenticated before most operations. The daemon caching feature stores encrypted data in memory, which may not be suitable for all security environments—use --cache=false to disable. Service accounts have different authentication flows than personal accounts.

1Password was founded by AgileBits in 2006 as a password manager for macOS. The command-line interface was first released in 2017 to support developer workflows and automation. Version 2 of the CLI, released in 2022, introduced the current noun-verb command structure, secret references, and improved service account support for CI/CD integration.

pass(1), gopass(1), vault(1), gpg(1)