Share your Claude Code and 1Password tips!

1Password Environments seem like a good option except they suffer from a few shortcomings currently.

In my case, I have a (normal, not virtual mounted) .env file that only contains secret references and I use `op run —env-file=.env — <command>` heavily, but when Claude Code is working on my behalf I am bombarded with re-authentication prompts as it likes to repeatedly run my test suite to validate its own work.

I had hoped that environments might help here, but it seems like if I mount the environment as a virtual .env file I still need something (dotenv) or similar to load that file into env vars for the command to access them. I believe this solves the auth prompt issue (as long as the desktop app is unlocked), but has other issues like only one process is allowed to read the virtual .env file at a time?

Alternatively I could skip the .env file altogether with `op run —environment <id> — <command>`, but that doesn’t reduce the number of auth prompts. It would be great if the `—environment` argument could require fewer auth prompts (similar to the virtual .env mount approach).

Then there is the complaint many others had that environments don’t support secret references, so you need to duplicate a secret already in the vault into the environment.

It seems like we’re so close to the nirvana of not having secrets stored on disk while still allowing agents to do their work (with access to environment secrets) without a human having to babysit them just for secret access.

Unless I’m mistaken on any of the above?

Late to this thread, but it made me build the thing I was missing.

Two problems I kept hitting:
- `op run -- claude` breaks the TTY (Claude Code falls into --print mode).
- Storing a new key meant pasting it into the chat, the one place it should never go.
- And, like scottohara above, biometric prompts on every command when Claude runs tests in a loop.

So: https://github.com/lucas-saldanha-werneck/Claude-1Password (MIT)
- `op-env claude` resolves `~/.claude/.env.tpl` (op:// references only) in one `op` call, exports, then execs Claude — TTY intact, one biometric prompt per session.
- `op-store <item>` opens a native dialog (Swift on macOS, with an eye toggle) and pipes the value to `op item create` as a JSON template, so it never touches argv or env.
- Claude Code hooks erase pasted secrets before the model sees them, and block `op read` / `printenv` / `.env` reads inside the session.

One thing worth knowing here: with the desktop-app integration, `op` inside the session can read every vault, not just the one you made for Claude. The README documents that and the service-account alternative. Feedback very welcome, especially from Windows/Linux users. (I also opened a PR to developer-community-projects.)