Skip to main content

1Password CLI reference

Manage 1Password vault metadata and item fields from the terminal. These commands let you list vaults and items, create fields, and rotate values — all without printing secret content.

Canonical executable surface​

Use the generated CLI command reference for the complete 1Password command tree and exact executable usage, flags, and displayed defaults. This page focuses on behavior, examples, output, and security.

Cobra lists but does not label required flags in --help. At execution time, 1Password item list requires --vault; item create and update require --vault, --item-path, --field, and --value-from-env.

Prerequisites​

RequirementDetail
OP_SERVICE_ACCOUNT_TOKENMust be exported in your shell
Vault accessService account needs read access (write access for create and update)

All commands use the 1Password Go SDK internally — no op CLI installation is required.

See Install and configure 1Password if you have not set up authentication yet.

Vault commands​

loom secrets op vault list​

List every vault the service account can access.

loom secrets op vault list

Output:

name=Engineering id=vlt_abc123
name=Platform    id=vlt_def456

Returns no op vaults found if the service account has no vault assignments.

Item commands​

loom secrets op item list​

List item paths and their field names within a vault.

Examples:

List all items in a vault:

loom secrets op item list --vault Engineering

Filter by prefix:

loom secrets op item list \
  --vault Engineering \
  --item-prefix services/loom

Output:

services/loom/deploy  password,token
services/loom/db      username,password

Returns no op items found if no items match.

loom secrets op item create​

Create a new item with a field. The value is read from an environment variable — never passed as a CLI argument.

Example:

export DEPLOY_TOKEN_VALUE="tok_abc123"

loom secrets op item create \
  --vault Engineering \
  --item-path services/loom/deploy \
  --field token \
  --value-from-env DEPLOY_TOKEN_VALUE

Output:

item field created: vault=Engineering item=services/loom/deploy field=token

loom secrets op item update​

Update an existing field value, or append the field if it does not exist on the item. Same env-var indirection applies.

Example:

export DEPLOY_TOKEN_VALUE="tok_rotated_456"

loom secrets op item update \
  --vault Engineering \
  --item-path services/loom/deploy \
  --field token \
  --value-from-env DEPLOY_TOKEN_VALUE

Output:

item field updated: vault=Engineering item=services/loom/deploy field=token

Security design​

All commands follow Loom's secrets security principles:

PrincipleHow it is enforced
No secret values in flagsMutation commands accept an environment-variable name through --value-from-env, keeping the value out of the command arguments. Shell setup and the process environment still need secret handling.
Metadata-only outputOutput shows vault names/IDs, item paths, and field names — never secret content
Fail closedMissing auth or invalid references produce structured error codes, not partial results

Next steps​