Inject 1Password secrets into a process or config file with op run and op inject without hardcoding values

Documented steps

1. Set OP_SERVICE_ACCOUNT_TOKEN in the environment to a service-account token scoped to the relevant vaults.
2. For process-level secrets, write a .env-style file whose right-hand sides are op:// references rather than literal values - for example a DB user variable set to op://prod/mysql/username and a DB credential variable set to op://prod/mysql/credential.
3. Run the process with those references resolved into its environment: op run --env-file=.env -- <your-command-referencing-the-env-vars>
4. op run resolves the op:// references and injects them as environment variables for the lifetime of the child process only; resolved values are never written to disk.
5. Rely on default masking: if a subprocess prints a secret to stdout, op run conceals it. Use --no-masking only in an isolated local debugging session, never in CI.
6. For config files, commit a template containing references instead of values, e.g. config.yml.tpl whose credential field is set to an op:// reference.
7. Render it at deploy time: op inject -i config.yml.tpl -o config.yml. Only the rendered output file contains plaintext.
8. Parameterize per environment where needed, e.g. APP_ENV=prod op inject -i config.yml.tpl -o config.yml
9. Delete the rendered output file as soon as it is consumed and add it to .gitignore so plaintext is never committed.
10. Official docs (verified 2026-07-29): https://www.1password.dev/cli/secret-references | https://developer.1password.com/docs/cli/secrets-config-files/