Set up 1Password + direnv for secure secret management in current project
Sets up 1Password CLI and direnv for secure secret management in projects.
/plugin marketplace add clearfunction/cf-devtools/plugin install cf-devtools@cf-devtools[account] e.g., 'mycompany.1password.com' (optional)secrets/Set up secure secret management using 1Password CLI with direnv.
Verify 1Password CLI is installed:
op --version
If not installed, inform user:
brew install --cask 1password-cli
Verify direnv is installed:
direnv --version
If not installed, inform user:
brew install direnv
echo 'eval "$(direnv hook zsh)"' >> ~/.zshrc # or ~/.bashrc
Check if 1Password is signed in:
op account list
If no accounts, inform user to sign in:
op signin --account=yourcompany.1password.com
Use AskUserQuestion to collect:
Q1: 1Password Account "What is your 1Password account domain?"
mycompany.1password.comQ2: Vault Name "Which vault contains your secrets?"
Development or PrivateQ3: Initial Secrets (optional) "What environment variables do you need? (comma-separated)"
DATABASE_URL, API_KEY, AWS_ACCESS_KEY_ID.env.op# 1Password Secret References
# Safe to commit - contains only op:// pointers, not actual secrets
#
# Format: VAR_NAME="op://Vault/Item/Field"
# Example: DATABASE_URL="op://Development/PostgreSQL/connection-string"
# Add your secret references below:
If user provided initial secrets, add placeholder entries:
DATABASE_URL="op://Vault/Item/Field" # TODO: Update with actual 1Password path
API_KEY="op://Vault/Item/Field" # TODO: Update with actual 1Password path
.envrc# Load secrets from 1Password using direnv
# Safe to commit - no secrets, just delegates to .env.op
direnv_load op run --env-file=.env.op --no-masking \
--account=ACCOUNT_DOMAIN -- direnv dump
Replace ACCOUNT_DOMAIN with the user's account.
.gitignoreCheck if .gitignore exists. If so, append (if not already present):
# 1Password + direnv
.direnv/
.env
.env.local
If no .gitignore, create one with these entries.
Note:
.envrcis safe to commit - it contains no secrets, just a loader command that delegates to.env.op.
Run direnv allow:
direnv allow
Provide usage instructions:
Setup complete!
Files created:
- .env.op (safe to commit - add your op:// references here)
- .envrc (safe to commit - no secrets, just loader command)
- .gitignore (updated with direnv entries)
Next steps:
1. Edit .env.op to add your secret references:
DATABASE_URL="op://Development/MyApp/database-url"
2. Test a secret resolves:
op read "op://Development/MyApp/database-url"
3. Reload the environment:
direnv allow
4. Verify secrets loaded:
echo $DATABASE_URL
To migrate an existing .env file, run:
/secrets:migrate
See the 1password-direnv-secrets skill for detailed documentation on:
op run pattern and why it's fasterop inject)