Skip to main content
March 15, 2026
Question

FR: Allow Environments to reference Vault Items

  • March 15, 2026
  • 3 replies
  • 57 views

Description: Currently, 1Password Environments and Vault Items are two completely separate systems with no connection between them. This creates a fundamental problem for professional workflows:

  •  Environments provide fast, secure secret delivery via Named Pipes – great for local development
  • Vault Items provide rotation, audit trails, access control, and CLI management – great for operations

But you have to choose one or maintain both in parallel, which means either giving up rotation or giving up fast secret delivery.

Proposed Solution: Allow an Environment variable to be linked to a Vault Item. The Environment would act as a structured view over Vault Items, not a separate data store.

Benefits:

  • Single source of truth – secrets live in Vault Items, Environments just expose them
  • Rotation works automatically – rotate the Vault Item, the Environment reflects the change immediately
  • Audit trail remains intact – all access and changes tracked in Vault Items
  • Named Pipe delivery stays fast – no change to the developer experience

 

3 replies

1Password Employee
April 13, 2026

Hey Shad0w! I love this idea. Thank you for sharing! 
My apologies on the delayed response here. I'll pass your suggestion along to the team for consideration :)

theo
April 16, 2026

I totally agree. In the meantime, you might like varlock - there is a 1Password plugin to pull data from both individual items and environments, and it will let you have a nice dev flow without writing anything to disk.

August 11, 2026

I 100% agree on this. I was baffled when I realized that this wasn’t possible already, without it I can barely see the use-case for environments at the moment. I’d want to use environments to expose groups of secrets for a given application or machine. As soon as there are overlapping uses of the same secret, using an environment is moot, since the whole point of a password & secret manager is that I don’t have to manually keep secrets in sync.

I wish we had programmatic write / management access to environements, then we could build our own automation for this. A service account and a per-environment key-to-secret-ref mapping file would suffice to keep things in sync as a workaround, but as of right now we only have read-only access to environments.

Only the MCP seems to have write access for some reason, but it doesn’t seem to be able to delete environments or variables.

I absolutely love 1Password and recommend it to everyone due to its excellent embodiment of the union of security and convenience. This is actually the first time I am encountering such a big issue with it, and it’s only with an in-development beta feature. So please keep up the good work and I am excited to see progress on this.

I’d love if we could see full management capabilities for environments and 1Password secret mappings built-in soon, that would push this feature into an essential must-use for us :)