1Password Environment Secrets

Store project environment variables in the existing 1Password Environment without exposing secret values in chat, logs, screenshots, repositories, or synchronized files.

Canonical configuration

• Environment: .env
• Environment ID file: ~/.config/op/environment-id
• Environment selection variable: OP_ENVIRONMENT_ID
• CLI: stable 1Password CLI with op run --environment support
• Local authentication: the user's 1Password desktop app integration and approval, including app unlock or Touch ID when requested

The Environment stores the variables. A service account is not required for this local workflow. Do not provision, reuse, or restore service-account authentication unless the user explicitly authorizes it.

Core rules