1Password Environment Secrets

Store project environment variables in the existing 1Password Environment without exposing secret values in chat, logs, screenshots, repositories, or synchronized files.

Canonical configuration

• Environment: .env
• Environment ID file: ~/.config/op/environment-id
• Service account: mac-studio-development
• Service account token file: ~/.config/op/service-account-token
• Token file mode: 600
• Authentication variables: OP_ENVIRONMENT_ID, OP_SERVICE_ACCOUNT_TOKEN

The Environment stores the variables. The service account only authenticates read access and does not contain variables itself.

Core rules