1Password CLI

Use the official op CLI for secrets consumed by commands or configuration. Prefer workflows in which the secret never appears in model context, terminal output, logs, chat, shell history, or a committed file.

References

• Read references/get-started.md for prerequisites, authentication modes, and platform notes.
• Read references/cli-examples.md for safe command patterns.

Workflow

1. Check the operating system and shell.
2. Verify the CLI without installing anything: op --version.
3. Identify the configured authentication mode:
   • OP_SERVICE_ACCOUNT_TOKEN is present: service account, usually for CI or headless use.
   • 1Password desktop integration is enabled: use the running, unlocked desktop app.
   • Neither applies: standalone interactive sign-in is required.
4. Verify access with op whoami before a secret-consuming operation.
5. If more than one account exists, use --account or the already-configured OP_ACCOUNT value.
6. Prefer op run or op inject; use op read only when its output can be consumed without being exposed.

If op is absent or authentication is not configured, explain the exact prerequisite and point to the official 1Password CLI documentation. Do not silently install the CLI, ask the user to paste a password or token into chat, invent credentials, or place a secret in tool arguments.

Authentication modes

Service account

The user must configure OP_SERVICE_ACCOUNT_TOKEN outside the conversation and agent command history. Do not print or inspect its value.

op whoami
op vault list

Service-account access is limited to its allowed vaults and does not require the desktop app.

Desktop app integration

Run op directly so it can reach the per-user desktop integration channel:

op vault list
op whoami