Skip to content
opv

Docs

Quickstart

From nothing to your app running with its secrets from 1Password, then a reviewed sync to a deployed environment. No value is ever printed along the way.

1. Install

npm works on every platform and picks the prebuilt binary. Without Node.js, on Linux or macOS, use the install script.

$ npm install -g @matthew-cochran/opv
$ curl -fsSL https://raw.githubusercontent.com/matt-cochran/1password-vault/main/install.sh | sh

You also need the 1Password CLI, op. On macOS and Windows, turn on Settings > Developer > Integrate with 1Password CLI in the 1Password app. Other ways to install

2. Sign in and init

In your project, sign in to the account the project uses, then create the dev environment. The vault defaults to <project>-dev and is created if missing; the configuration is saved in 1Password.

your project
$ opv login --account you@example.com
$ opv init dev

3. Declare keys

Declare each key with its kind. opv check adds the empty field; then open it in 1Password, click Edit and type the value there, the only place a value is typed.

your project
$ opv add API_KEY --kind secret --env dev
$ opv check dev
$ opv open API_KEY

4. Run locally

Start your app with the environment's keys as environment variables, through op run, with no .env file on disk.

your project
$ opv run dev -- npm run dev

In a checkout of a project whose configuration already lives in 1Password, no file is needed: opv finds it by the repository's git remote. opv login dev then opv run dev -- npm run dev.

Already have a .env?

Declare every key and import the values, verified, in one step. Without --apply it only shows the plan.

$ opv init dev --from .env --apply

5. Deploy

Give an environment a target (Fly.io, GitHub Actions, Azure or Kubernetes) in the configuration. Then check it, review the plan, and apply exactly that plan.

your project
$ opv status prod                # one row per key, problems first
$ opv plan prod                  # what a sync would write, hold and prune
$ opv sync prod --deploy --expect-plan 412a5b23

If anything changed since the plan, the sync refuses before any write and prints the new id. Prefer a terminal UI? Run opv ui.

With an AI assistant

Install the agent skill so every Claude Code, Codex or Cursor session starts from opv ready --json and never handles a secret value. With the script: … | sh -s -- --skill.

$ opv skill install --user

Full reference