Download 1Password CLI beta1Password CLI 2.44.0-beta.01 is now available. 🎉
This release adds 1Password Shell Plugins for Doppler, Netlify, npm and pnpm, Postman, and more, and improves several existing shell plugins. It also fixes how op item get, op read, op run, and op inject handle address fields when some parts are empty.
Subscribe to the RSS feed for 1Password CLI beta release notes.
To download 1Password CLI beta builds, navigate to the 1Password CLI downloads page and select Show betas.
On Linux, you can switch the channel from “stable” to “beta” when adding the 1Password repository in your package manager.
- You can now authenticate the following CLIs using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to everyone who contributed!
- CockroachDB CLI (
cockroach sql), contributed by @syndbg Git reference #shell-plugins#536 - Doppler CLI, contributed by @CodeByZach Git reference #shell-plugins#562
- DuckDB CLI with MotherDuck, contributed by @sterlinm Git reference #shell-plugins#511
- LocalXpose CLI (
loclx), contributed by @LocalXpose Git reference #shell-plugins#534 - Netlify CLI, contributed by @eddumelendez Git reference #shell-plugins#627
- npm and pnpm, contributed by @dalldrit13 Git reference #shell-plugins#658
- Octopus Deploy CLI, contributed by @xcezx Git reference #shell-plugins#623
- OpenBao CLI (
bao), contributed by @gaige Git reference #shell-plugins#576 - Postman CLI, contributed by @ericflores108 Git reference #shell-plugins#448
- Spacelift CLI (
spacectl), contributed by @damianstasik Git reference #shell-plugins#285 - Stackhero CLI, contributed by @martijngastkemper Git reference #shell-plugins#671
- xAI Grok CLI, contributed by @eddumelendez Git reference #shell-plugins#626
- The Argo CD shell plugin now respects the selected context. Credentials from 1Password are only provided when
argocd is targeting the server stored in the item’s Address, so --argocd-context and --server work as they do without the plugin. Git reference #shell-plugins#678 - The Akamai and Pipedream shell plugins now refuse to write credential values containing line breaks into their generated config files. Git reference #shell-plugins#677
- The Exercism shell plugin no longer requires a 1Password item for the
completion, upgrade, workspace, and troubleshoot subcommands. Git reference #shell-plugins#665 - The Sourcegraph shell plugin now supports the current
sgp_ access token format. The Endpoint field is now required, since each token is tied to a specific endpoint. Thanks @marcleblanc2! Git reference #shell-plugins#593 - The Hugging Face shell plugin now uses the new
hf command instead of huggingface-cli. Run op plugin init hf and remove the old huggingface-cli alias. Thanks @cadnza! Git reference #shell-plugins#573 - The Terraform shell plugin now provides credentials to
terraform output and terraform taint commands. Thanks @juraj-s! Git reference #shell-plugins#556 - The LocalStack shell plugin now uses
LOCALSTACK_AUTH_TOKEN instead of the deprecated LOCALSTACK_API_KEY. Thanks @simonrw! Git reference #shell-plugins#428 - The MySQL shell plugin now quotes and escapes the values it writes to the generated
my.cnf, so passwords containing #, backslashes, or surrounding whitespace no longer fail to authenticate. Git reference #shell-plugins#672 - The OpenTofu shell plugin now provides credentials to
tofu workspace commands, matching the Terraform shell plugin. Git reference #shell-plugins#666 - The Gitea shell plugin now writes tea’s configuration to the location tea reads when
XDG_CONFIG_HOME is set. Git reference #shell-plugins#620 - The AWS shell plugin no longer fails with
Cannot call GetSessionToken with session credentials when a profile with MFA assumes a role through a source_profile. Git reference #shell-plugins#684 op item get, op read, op run, and op inject now return the value of an address field when some parts of the address, such as the street or country, are empty. #DI-1185op environment help text now uses “secrets” instead of “variables”. #DEVAI-291
- The
op environment secret list command now lists the name and value of each secret in a 1Password Environment, and whether each secret is concealed. #DG-1317 - The output
--format flag now includes a dotenv format option for 1Password Environment secrets. #DW-1443
op read help text now includes an example of reading a file attachment. #TW-1440
- Updated the CLI base image on linux/amd64 and linux/arm64 to the latest hardened build to pull in security fixes. #INFRASEC-1908 #INFRASEC-1824
- Updated Go to 1.26.10 to pull in the latest security fixes. #INFRASEC-1824
- Reduced
op environment read and op run --environment network requests from 6 to 4. #DW-1414 - Improved WASM performance of SDK-backed commands. #DI-1120
- Updated Go to 1.26.8 and the
golang.org/x/crypto, golang.org/x/net, and golang.org/x/text modules to fix known security vulnerabilities. #DEVECO-364
- Accounts with 1Password Environments no longer re-fetch the full vault list from the server on every command. #DI-817
- Accounts with no readable vaults no longer re-fetch the full vault list from the server on every command. #DI-817
- On macOS, running
op repeatedly from a coding agent, script, or other program no longer prompts for authorization on every command; successive invocations now share a single desktop app authorization. #DI-1135 - Clarified in
op run help and the CLI reference that secret masking on stdout and stderr is best effort and does not guarantee concealment. #DI-1088
- Debug output now includes per-request timing. #ECO-971
- 1Password Environments commands are now significantly faster on Apple silicon Macs. #DG-1398
- Debug output now reports more information when a vault cannot be read. #ECO-817
- Reporting item usage for cached items no longer delays reading secrets. Usage data is now sent in the background. #ECO-970
- A vault lookup that fails on the server is now reported as an error instead of incorrectly saying the vault isn’t in the account. #ECO-1017
- Connection error messages no longer include the full request URL, which could contain the account’s email address. #ECO-817
- Reading an item with
op read or op item get is now faster, using one fewer network round-trip per read. #ECO-815 - Reading an item or vault by name is now faster:
op read, op item get, op item list, and op vault get use one fewer network round-trip when resolving a name. #ECO-816
- You can now trigger a Google Workspace user provisioning sync with
op provisioning google sync. #PROV-1718
- You can now authenticate the following CLIs using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to everyone who contributed!
- Cline CLI, contributed by @eddumelendez Git reference #shell-plugins#611
- CrateDB CLI, contributed by @accraw Git reference #shell-plugins#394
- Cursor CLI, contributed by @eddumelendez Git reference #shell-plugins#612
- Descope CLI, contributed by @scottisloud Git reference #shell-plugins#570
- Exercism CLI, contributed by @dethancosta Git reference #shell-plugins#404
- Expo and EAS CLIs, contributed by @CodeByZach Git reference #shell-plugins#563
- GitHub Copilot CLI, contributed by @eddumelendez Git reference #shell-plugins#603
- Google Gemini AI API CLI, contributed by @fproulx-boostsecurity Git reference #shell-plugins#560
- Jetbrains Junie CLI, contributed by @eddumelendez Git reference #shell-plugins#604
- Kiro CLI, contributed by @eddumelendez Git reference #shell-plugins#605
- OpenCode CLI, contributed by @eddumelendez Git reference #shell-plugins#613
- OpenTofu CLI, contributed by @gargakshit Git reference #shell-plugins#560
- PyPI for twine, flit, and hatch, contributed by @cpierce Git reference #shell-plugins#589
- UpCloud CLI, contributed by @jksolbakken Git reference #shell-plugins#538
- The GitHub shell plugin now provisions
GH_ENTERPRISE_TOKEN for GitHub Enterprise Server hosts and supports authenticating to both github.com and Enterprise when separate credentials are configured. Thanks @scottisloud! Git reference #shell-plugins#610 - The Redis CLI shell plugin now supports authenticating Redis CLI with environment variable-based provisioning. Thanks @arunsathiya! Git reference #shell-plugins#276
- Tab completion is now supported when using shell plugins with bash and zsh shells. #40
op no longer hangs when running a shell plugin from outside $HOME. Git reference #shell-plugins#416- Terraform
workspace subcommands now trigger authentication when using 1Password Shell Plugins. Thanks @moraisph! Git reference #shell-plugins#582 - The Oh Dear shell plugin now checks for the
~/.ohdear/config.json file and attempts to import credentials. Thanks @owenvoke! Git reference #shell-plugins#577 - The deprecated
zsh.initExtra option has been replaced with zsh.initContent in the nix shell plugin. Thanks @jbhannah! Git reference #shell-plugins#550 - The awslogsCLI function has been renamed to capitalize CLI for consistency. Git reference #shell-plugins#518
- Deleting an invited or not-yet-activated user no longer fails on accounts with the Account Trust Log enabled. #TRUST-862
- You can now use
op user create when automated provisioning is enabled. #PROV-1532 - You can now use
op user suspend when automated provisioning is enabled. #PROV-1544 - You can now use
op user reactivate when automated provisioning is enabled. #PROV-1545 - You can now use
op provisioning configure to set up automated provisioning. #PROV-1532
- Authenticate the Claude Code CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks @malob! Git reference #shell-plugins#519
- Authenticate the Scaleway CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks @jksolbakken! Git reference #shell-plugins#515
- The AWS plugin now supports the
awslogs CLI. Thanks @jonasws! Git reference #shell-plugins#504 - The AWS plugin now supports
eksctl, the Amazon EKS CLI. Thanks @skpaz! Git reference #shell-plugins#500 - The AWS shell plugin now supports the AWS SAM CLI. Thanks @simonmcc! Git reference #shell-plugins#473
- The OpenAI shell plugin now supports the Codex CLI. Thanks @shyim! Git reference #shell-plugins#517
- The Terraform shell plugin now triggers authentication for all
terraform state subcommands, not just terraform state list. Thanks @frans-otogone! Git reference #shell-plugins#476 - The ngrok shell plugin no longer performs a version check on every
op plugin command when it is not initialized. Thanks @MOmarMiraj! Git reference #shell-plugins#474 - The AWS CDK shell plugin now supports AWS Profiles that assume a role when specified by the
--profile flag. Thanks @waiteb3! Git reference #shell-plugins#463 op run now properly terminates the subprocess it was called with when cancelled (for example, with Ctrl+C). #284
- 1Password CLI commands now support the Account Trust Log when the user authenticates with the 1Password desktop app.
- 1Password CLI now correctly updates an account’s Account Trust Log when the feature is enabled.
- 1Password CLI now supports updating an account’s Account Trust Log when the feature is enabled.
op environment help text now includes information about how to get the ID for a 1Password Environment.
op environment read allows reading environment variables from 1Password Environments. #DG-538op run now supports loading variables from 1Password Environments by passing the --environment flag. #DG-31
- An issue with the 1Password desktop app integration on Windows operating systems has been fixed. You can now use the 1Password CLI beta build with the latest nightly and beta releases of 1Password for Windows. #4325
- 1Password CLI no longer causes direnv to halt when the two are used together. #4250
- Following the deprecation of CLI 1, the
1password/op:latest DockerHub tag will now always point to the latest version of CLI 2. #4267 op vault list --filter now returns all vaults you have access to regardless of permission level, making it easier to discover and manage vaults beyond those where you have read access. #4189op group user grant now works correctly in MSP accounts. #4244
Developer tools
