Storing command line secrets in 1Password

I used to have many API keys available in environment variables in any terminal session. Obviously, it is a bad idea, as any script I run on my machine could potentially leak these secrets. To address this, I decided to store them in 1Password (my password manager of choice) instead.

Welcome environments in 1Password CLI

1Password offers a handy way to organize secrets in environments. This can be especially useful when working with multiple projects that require different sets of secrets.

In the 1Password app, in the Developer section, you can create environments and add secrets to them. After that you just run

op run --environment <environment-id> -- <command>

and the secrets will be available in the environment variables of the command you run.

Yes, it is that easy.

Other advantages

You can also access individual secrets, but I really like using environments as it is much faster and more convenient.

Another advantage of using 1Password to store secrets is that I can easily share them between multiple machines. And, if needed, with other team members too.

Improving security and simplifying my workflow one step at a time

And while migrating all secrets, I used the opportunity to also remove any unnecessary secrets and rotate others.

Subscribe to all blog posts via RSS