1Password/Environment

• Environments

  • Overview

    • 1Password Environments hold a project's EnvVars as a first-class object, separate from ordinary vault items. Each Environment is a named set of key-value pairs that can be shared, mounted, and read without writing plaintext secrets to disk.

  • Context

    • Earlier garden notes treat this as an open idea — 1Password/Idea/Populate EnvVars — and as a CLI-era how-to that substitutes op references into EnvVar/.env files: 1Password/Dev/How To/Replace .env secrets with op refs. Environments is the product-shaped answer: import an existing .env file (or add variables by hand), then consume them through mounts, 1Password/Dev/CLI, 1Password/Dev/SDK, or 1Password/Environment/MCP.
    • The feature lives in the 1Password desktop app (Mac, Windows, Linux), not iOS or Android, and an Owner or Administrator must turn the Environments policy on.

  • Key Principles

    • Separate from vault items — Environment variables are scoped to a project or stage, not mixed into the rest of a vault.
    • Values are returned as stored — 1Password does not rewrite what is saved. Quote spaces and escape special characters the way a .env file would.
    • Hidden by default — values are masked in CLI and SDK output unless a variable is marked "show value by default."
    • Share per Environment — on a team or business account, access is granted per Environment, not for all Environments at once.

  • Mechanism

    • Create and edit Environments under Developer → View Environments in the desktop app.
    • Consume them by:
      • mounting a local .env file that does not write credentials to disk
      • an agent hook that validates that mount in supported IDEs and agents
      • programmatic reads via 1Password/Dev/CLI or 1Password/Dev/SDK
      • syncing to AWS Secrets Manager
      • 1Password/Environment/MCP for agent clients
    • Turning the Environments policy off hides existing Environments; it does not delete them.

  • Examples

    • One Environment per project, or per stage (dev / staging / prod), imported from an existing .env.
    • 1Password/GitHub/1password-codex-plugin wires Codex to 1Password/Environment/MCP so Codex can list Environments and mount .env files without receiving secret values.

  • Misconceptions

    • A mounted .env is a plaintext file on disk — the mount makes variables available on demand; credentials are not written to disk.
    • Importing a leaked .env remediates the leak — moving secrets into 1Password secures them going forward; it does not undo prior exposure in git history or agent memory. Rotate those values.
    • Deleting an Environment is reversible — deleted Environments cannot be restored, and associated integrations stop working.

  • Experiments

    • 2026-10-02: more than one mount, and deleting a mount's folder

      • Observations from one run at about 12:20 ET on macOS, with the 1Password desktop app, 1Password CLI 2.39.0 and the 1Password/Environment/MCP server (1password-mcp). They are not documented behaviour, except where a link says so. Nothing was read from the mounted file.
      • One Environment can have more than one mount.
        • The server's create_local_env_file added a second local .env mount of a test Environment, in a scratch folder, beside an existing mount.
        • list_local_env_files listed both as enabled, and the desktop app showed both under Connected to.
        • The new file was a named pipe (prw-------).
      • Deleting a mount's folder does not remove the mount.
        • After rm -rf of the scratch folder, list_local_env_files still listed the mount as enabled a minute later, and the desktop app still showed it.
        • 1Password did not recreate the file in the 30 seconds watched.
        • Removing a git worktree deletes its folder the same way, so it would leave its mount registered. That mount probably still counts toward the limit of ten enabled local .env files per device; this was not checked.
      • No program was found that removes a mount.
        • The installed MCP binary names only its eight tools, and none removes a mount.
        • The CLI reference lists one op environment subcommand, read (reference), and op 2.39.0 has no environment command.
        • The ⋮ menu on the mount in the desktop app is the only way found.
      • For coding agents that mount one .env per git worktree, each finished worktree leaves a mount to remove by hand, inside a limit of ten per device.