Get started with 1Password CLI 1

Upgrade to 1Password CLI 2

1Password CLI 1 is deprecated as of October 1, 2024. Scripts and integrations that use version 1 will no longer work as expected. Upgrade to 1Password CLI 2 to maintain uninterrupted access and compatibility with the latest features.

The first time you sign in to a 1Password account with 1Password CLI, you'll need your sign-in address, Secret Key, email address, and account password.

Your sign-in address is the URL you use to sign in to your account on 1Password.com (my.1password.com in this example). The subdomain for your sign-in address (my in this example) will be the shorthand 1Password CLI uses to refer to your account.

To specify a custom shorthand, use --shorthand <name> on your first sign-in.

To sign in to an account for the first time:

1. Use op signin with your sign-in address and email address:

2. Enter your Secret Key, then enter your account password.

3. Use the eval (Mac, Linux) or Invoke-Expression (Windows) command returned by the tool to save your session token to an environment variable automatically. Or run the export command to set it manually.

   On Mac and Linux:

   On Windows:

The eval and Invoke-Expression commands use your account shorthand as an argument to specify which account to sign in to. In the example above, the shorthand my refers to my.1password.com.

Now that you have a session token, you can start using 1Password CLI. Session tokens expire after 30 minutes of inactivity, after which you'll need to sign in again and save a new token.

After the first time you sign in to an account, you can use a shorter command to sign in again:

If you've added multiple accounts to 1Password CLI, you can choose which account to sign in to by specifying the shorthand. For example:

If no shorthand is provided, 1Password CLI will default to the most recently used account.

To see all of the accounts you've previously authenticated and their shorthands:

Learn more

You can use 1Password CLI to work with users, vaults, and items. For example, here's how to upload a document to your Private vault:

To see a list of all the items in your Shared vault:

The output will show the UUIDs of the items. To get the details of an item:

You can use names or UUIDs in commands that take any user, vault, or item as an argument. Use UUIDs because they'll never change, so you can be sure you're always referring to the same object. It's also faster and more efficient.

You can get details of just the fields you want. For one field, 1Password CLI returns a simple string:

For multiple fields, specify them in a comma-separated list. 1Password CLI returns a JSON object:

Parse and manipulate JSON output with jq

Every op command outputs in one of two formats: a simple string, like a UUID, or JSON. To parse and manipulate JSON output, we recommend the command-line tool jq.

To use jq to parse a Login item called "WestJet" and retrieve the password:

To use jq to manipulate a Login item template, set the username value to "wendy", and save the item in your Private vault:

On Mac and Linux:

On Windows:

Learn more about jq.

Get help

To check for updates to 1Password CLI:

If a newer version is available, 1Password CLI can download it for you.

You can see a list of all commands with op --help, or learn about a specific commands with op <command> --help.