2.41.0 (build #2410001)

This release makes the `--environment` flag for `op run` generally available, so you can retrieve and use secrets from 1Password Environments in your scripts and programs.

New

• `op run` now supports the `--environment` flag to load secrets from 1Password Environments. {1461}

Improvements

• Reduced `op run --environment` network requests from 6 to 4. {DW-1414}
• Improved WASM performance of SDK-backed commands. {DI-1120}

2.40.0 (build #2400001)

This release adds support for syncing user provisioning with Google Workspace.

Commands are also faster for accounts with 1Password Environments or with no readable vaults. Go and several Go libraries are updated to fix known security vulnerabilities.

New

• You can now trigger a Google Workspace user provisioning sync with `op provisioning google sync`. {PROV-1718}

Improvements

• In accounts with 1Password Environments, or with no readable vaults, the full vault list is no longer re-fetched on every command. {DI-817}

Security

• Updated Go to 1.26.8 and the "golang.org/x/crypto", "golang.org/x/net", and "golang.org/x/text" modules to fix known security vulnerabilities. {DEVECO-364}
• Clarified in `op run` help text that secret masking on stdout and stderr is best effort and does not guarantee concealment. {DI-1088}

2.39.0 (build #2390001)

This release makes the CLI faster: reading secrets no longer waits on usage reporting. It also improves debug output and includes other fixes.

New

• Debug output now includes per-request timing. {ECO-971}

Improvements

• Debug output now reports more information when a vault cannot be read. {ECO-817}
• Reporting item usage for cached items no longer delays reading secrets: usage data is now sent in the background. {ECO-970}

Fixed

• A vault lookup that fails on the server is now reported as an error instead of incorrectly saying the vault isn't in the account. {ECO-1017}

Security

• Connection error messages no longer include the full request URL, which could contain the account's email address. {ECO-817}

2.38.1 (build #2380101)

This release makes reading items faster. Commands like `op read` and `op item get` now make up to two fewer network round-trips per read. The improvement is largest on higher-latency connections, where each saved round-trip counts for more.

Improvements

• Reading an item with `op read` or `op item get` is now faster, using one fewer network round-trip per read. {ECO-815}
• Reading an item or vault by name is now faster: `op read`, `op item get`, `op item list`, and `op vault get` use one fewer network round-trip when resolving a name. {ECO-816}

2.35.0 (build #2350001)

This release adds support for various shell plugins, as well as better User deletion handling for Automated Provisioning.

New

• Authenticate the OpenCode CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @eddumelendez for their contribution! {shell-plugins#613}
• Authenticate the Cursor CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @eddumelendez for their contribution! {shell-plugins#612}
• Authenticate the Cline CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @eddumelendez for their contribution! {shell-plugins#611}
• Authenticate the Kiro CLI with API keys using 1Password Shell Plugins. Thanks to @eddumelendez for their contribution! {shell-plugins#605}
• Authenticate JetBrains Junie CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @eddumelendez for their contribution! {shell-plugins#604}
• Authenticate the GitHub Copilot CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @eddumelendez for their contribution! {shell-plugins#603}
• Authenticate twine, flit, and hatch to PyPI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @cpierce for their contribution! {shell-plugins#589}
• Authenticate the Descope CLI as a Descope account admin using 1Password Shell Plugins. Thanks to @scottisloud for their contribution! {shell-plugins#570}
• Authenticate the Expo and EAS CLIs using 1Password Shell Plugins. Thanks to @CodeByZach for their contribution! {shell-plugins#563}
• Authenticate the Google Gemini AI API CLI using 1Password Shell Plugins. Thanks to @fproulx-boostsecurity for their contribution! {shell-plugins#560}
• Authenticate the OpenTofu CLI with any supported provider using 1Password Shell Plugins. Thanks to @gargakshit for their contribution! {shell-plugins#553}
• Authenticate the UpCloud CLI using 1Password Shell Plugins. Thanks to @jksolbakken for their contribution! {shell-plugins#538}
• Authenticate the Exercism CLI using 1Password Shell Plugins. Thanks to @dethancosta for their contribution! {shell-plugins#404}
• Authenticate the CrateDB CLI using 1Password Shell Plugins. Thanks to @accraw for their contribution! {shell-plugins#394}
• The GitHub shell plugin now provisions `GH_ENTERPRISE_TOKEN` for GitHub Enterprise Server hosts and supports authenticating to both github.com and Enterprise when separate credentials are configured. Thanks to @scottisloud for their contribution! {shell-plugins#610}
• The Redis CLI shell plugin now supports authenticating Redis CLI with environment variable-based provisioning. Thanks to @arunsathiya for their contribution! {shell-plugins#276}

Improvements

• Tab completion is now supported when using shell plugins with bash and zsh shells. {shell-plugins#433}

Fixed

• `op` no longer hangs when running a shell plugin from outside $HOME. {shell-plugins#416}
• Terraform 'workspace' subcommands now trigger authentication via 1Password Shell Plugins. Thanks to @moraisph for their contribution! {shell-plugins#582}
• The Oh Dear shell plugin now checks for the `~/.ohdear/config.json` file and attempts to import credentials. Thanks to @owenvoke for their contribution! {shell-plugins#577}
• The deprecated `zsh.initExtra` option has been replaced with `zsh.initContent` in the nix shell plugin. Thanks to @jbhannah for their contribution! {shell-plugins#550}
• The awslogsCLI function has been renamed to capitalize CLI for consistency. {shell-plugins#518}
• Deleting an invited or not-yet-activated user no longer fails on accounts with the Account Trust Log enabled. {TRUST-862}

2.34.1 (build #2340101)

This release improves the help text for how the Travel Mode flag works.

Improvements

• The 'op vault edit' help text now better describes how the Travel Mode flag works. {TW-1197}

2.34.0 (build #2340001)

This release adds support for various shell plugins and fixes a bug in `op run` where termination signals were not being forwarded to sub-processes.

New

• Authenticate the Claude Code CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @malob for their contribution! {shell-plugins#519}
• Authenticate the Scaleway CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @jksolbakken for their contribution! {shell-plugins#515}
• The AWS shell plugin now supports the `awslogs` CLI. Thanks to @jonasws for their contribution! {shell-plugins#504}
• The AWS shell plugin now supports `eksctl`, the Amazon EKS CLI. Thanks to @skpaz for their contribution! {shell-plugins#500}
• The AWS shell plugin now supports the AWS SAM CLI. Thanks to @simonmcc for their contribution! {shell-plugins#473}
• The OpenAI shell plugin now supports the Codex CLI. Thanks to @shyim for their contribution! {shell-plugins#517}

Fixed

• The ngrok shell plugin no longer performs a version check on every `op plugin` command when it is not initialized. Thanks to @MOmarMiraj for their contribution! {shell-plugins#474}
• The AWS CDK shell plugin now supports AWS Profiles that assume a role when specified by the `--profile` flag. Thanks to @waiteb3 for their contribution! {shell-plugins#463}
• `op run` now properly terminates the subprocess it was called with when cancelled (for example, with Ctrl+C). {284}

2.33.1 (build #2330101)

This release fixes an issue for accounts with the Account Trust Log enabled that prevented 1Password CLI from updating the Trust Log when using the 1Password desktop app to authenticate. It also adds a warning about updating items that contain passkeys to the `op item edit` help text.

Improvements

• `op item edit` help text now includes a warning that JSON item templates don't support passkeys. {INTF-1083}

Fixed

• 1Password CLI commands now support the Account Trust Log when the user authenticates with the 1Password desktop app. {TRUST-628}

2.33.0 (build #2330001)

This release adds support for updating an account's Account Trust Log when the feature is enabled, as well as other fixes.

New

• 1Password CLI now supports updating an account's Account Trust Log when the feature is enabled.

Fixed

• The `--tags` flag on `op item edit` now replaces existing tags instead of appending them. An empty `--tags` value now properly clears all tags.
• Empty tag strings in templates are now filtered out during `op item create` and `op item edit`.
• Default values for Date and MonthYear fields are now unset instead of zero. {INTF-189}

Security

• Upgrade Go to 1.24.12 to resolve vulnerabilities. {0}
• Upgrade Go to 1.25.7 to resolve vulnerabilities. {0}

2.32.1 (build #2320101)

This release brings improvements to help text, item tags, and exit codes when encountering an unknown error.

Improvements

• The `op item delete` help text now notes that deleted items remain in Recently Deleted for 30 days. {4377}
• Tags are now deduplicated when using `op item edit`. {4088}
• 'op run' help text now notes shell expansion order of operations. {2971}

Fixed

• `op item create` help text example now works without error. {4246}
• 1Password CLI now correctly exits with code 1 instead of 0 when encountering server error codes that are not recognized by the CLI. {DG-682}

2.32.0 (build #2320003)

This release adds support for recovering family and team member accounts with 1Password CLI.

New

• You can now use 1Password CLI to recover accounts for family or team members. {4161}

2.31.1 (build #2310102)

This release fixes the 1Password CLI integration with the desktop application on Windows. To use the desktop app integration, download the latest version of [1Password for Windows](https://releases.1password.com/windows/).

Fixed

• The 1Password app integration with 1Password CLI now works again on Windows. {4325}
• A typo in the error message for 'op user confirm' has been fixed. {4329}

2.31.0 (build #2310002)

This release includes quality of life improvements and bug fixes for 1Password CLI.

Improvements

• 1Password CLI no longer causes direnv to halt when the two are used together. {4250}
• Following the deprecation of CLI 1, the `1password/op:latest` DockerHub tag will now always point to the latest version of CLI 2. {4267}

Fixed

• The Go version has been bumped to 1.23.8. {4305}
• `op vault list --filter` now returns all vaults you have access to, regardless of permission level, making it easier to discover and manage vaults beyond just those with read access. {4189}
• 'op group user grant' now works correctly in MSP accounts. {4244}

2.30.3 (build #2300301)

This release includes security improvements, bug fixes for 1Password CLI commands, and introduces enhanced configuration options.

Improvements

• The `OP_RUN_NO_MASKING` environment variable is now exposed to allow users to control the masking of the `op run` command output. {4089}

Fixed

• For 1Password accounts that are managed by an MSP, 1Password CLI commands involving Service Accounts, Connect, or the Events API no longer occasionally return an error. {4033}
• The `op read`, `op run` and `op inject` commands no longer query archived items. {3893}

Security

• On Windows, the CLI now checks each signature of the 1Password desktop app before connecting to it. {4136}

2.30.0 (build #2300006)

This release enables caching for service accounts and concealing sensitive information in the human readable output of items, as well as brings multiple other improvements and bug-fixes.

Improvements

• Sensitive values from item management commands' human-readable output are now concealed and can be displayed using the `--reveal` flag. {4158}
• Caching is now being used for service account sessions on macOS and Linux. {4133}
• The error message when the CLI can't connect with the 1Password desktop app now includes a link to troubleshooting documentation for more help. {3933}
• `op whoami` will now signal if the CLI is authenticated as a human user. {4104}
• The output of `op vault list` now contains the created date and item count for each vault. {4092}

Fixed

• The `op item move` and `op item delete` commands now also work for SSH Key items. {3951}
• The `op vault revoke user` command will no longer allow you to revoke permissions in a Personal, Private, or Employee vault. {3844}
• When the same environment variable name exists both in the OS environment and the dotenv file, `op run` now correctly sources the value from the dotenv file. {3667}

Security

• Windows Authenticode signature now uses the SHA256 hashing algorithm. {4135}

2.29.0 (build #2290001)

This release adds support for administrators and owners to allow any user or group to create service accounts. It also includes other improvements to service accounts and Connect.

Improvements

• Adjust service account creation functionality to support the new feature of enabling other users and groups to create service accounts. {3960}
• You can now use the `op whoami` command with a 1Password Connect server. {2636}
• Service account tokens now include device UUIDs for scalability purposes. {4009}
• The output when you create a service account can now be formatted as a json object by adding `--format json` to the command. {3996}

2.28.0 (build #2280001)

This release updates the name of the Private vault for 1Password Business accounts to "Employee vault", and also improves SSH key support and the macOS package installer.

New

• Private vaults have been renamed Employee vaults for 1Password Business accounts. {3810}

Improvements

• 1Password can now retrieve PKCS1-formatted SSH keys using `op read`. {3993}

Fixed

• The 1Password CLI package installer for macOS now correctly displays the CLI version in the package receipt. {4027}

2.27.0 (build #2270003)

This release includes error message improvements as well as fixes in SSH key formatting and permission management.

Improvements

• `op read` will now output an error message consistent with the secret reference provided, when no matching field or section is found within the item. {3592}

Fixed

• Output of SSH private keys on non-DOS OSes no longer includes the carriage return character in line-breaks. {3913}
• Users and groups can now grant and revoke permissions if they have the `manage_vault` permission. {3863}

2.26.1 (build #2260101)

This release builds the 1Password CLI for Darwin with an updated toolchain.

Security

• The CLI build for Darwin now builds with Go 1.21.8. The previous version was built using an older version, which was causing alerts for certain customers.

2.26.0 (build #2260001)

This release gives you the ability to use 1Password CLI to manage 1Password Service Accounts, including commands to create service accounts and fetch service account rate limit usage. This release also brings other improvements and fixes for a better experience.

New

• `op service-account create` command allows you to create a new service account that you can use to automate secrets management.
• `op service-account ratelimit` command allows you to fetch information about service account rate limit usage. {3886}

Improvements

• The `op user provision` command now clarifies that users will not be considered for billing until they accept their invitation. {3965}
• `--expires-in` flags now include support for days and weeks. {3298}
• The `item share --expiry` flag is now aliased to the standardized `--expires-in` flag. {3298}

Fixed

• Corrected a typo in `user suspend` error message. {3298}

2.25.1 (build #2250101)

This release fixes a bug with the SSH key handling in the CLI.

Fixed

• Retrieving an SSH Key using the CLI with Connect now works as expected. {3851}

2.25.0 (build #2250001)

This release improves how 1Password CLI lists vault permissions and fixes a bug related to updating password strength when editing items.

Improvements

• `op vault list --permission` now allows you to retrieve a list of vaults for which a user or group has specific permissions. {3879}

Fixed

• When setting a non-generated password, 1Password CLI now always correctly updates the password strength. {3787}

2.24.0 (build #2240001)

This release contains help-text improvements and two fixes, as well as an improved customizable installer for the CLI on MacOS.

Improvements

• The 1Password CLI MacOS installer now allows for custom location selection. {3731}
• Help text now uses present tense more consistently where actions in the present are described. {3768}
• Help text now refers to the 1Password app consistently. {3626}
• Help text now refers to Connect server instances and tokens consistently. {3476}

Fixed

• `op group user grant` and `op group user revoke` no longer panic when the group doesn't exist. {3859}
• Duo MFA is no longer more often prompted for than required. {3907}

2.23.0 (build #2230001)

This release introduces a new way of editing items, brings fixes to the item creation and editing commands as well as improves error messages.

New

• `op item edit` now accepts JSON input via the `--template` flag. {1849}
• `op item edit` now supports piping items as JSON via stdin. {1849}

Improvements

• The CLI now returns a helpful error when a user is not an owner and tries to add the Team Members group to a vault when the feature flag limitGroupVaultAccess is enabled. {3830}
• Error message now suggests rebooting the app when the CLI cannot connect. {3835}

Fixed

• Error for `op item edit` when duplicate fields are found now formats better the field label that isn't in a section. {3849}
• Creating a vault with --icon=name now works again, using the updated icons. {3833}

Security

• Error for `op item edit` when duplicated fields are found by label no longer prints the field's value. {3848}

2.22.0 (build #2220002)

This release adds 16 new Shell Plugins, improves some of our help text and error messages, and includes a variety of other improvements and bug fixes.

New

• Authenticate the Hugging Face CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @bala-ceg for their contribution! {shell-plugins#393}
• Authenticate the InfluxDB CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @bala-ceg for their contribution! {shell-plugins#392}
• Authenticate the Binance CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @bala-ceg for their contribution! {shell-plugins#391}
• Authenticate the LocalStack CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @simonrw for their contribution! {shell-plugins#371}
• Authenticate the Crowdin CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @JoeKarow for their contribution! {shell-plugins#359}
• Authenticate the Axiom CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @rajapri28613 for their contribution! {shell-plugins#342}
• Authenticate the Kaggle CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @rajapri28613 for their contribution! {shell-plugins#341}
• Authenticate the Todoist CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @rajapri28613 for their contribution! {shell-plugins#340}
• Authenticate the Pipedream CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @rajapri28613 for their contribution! {shell-plugins#338}
• Authenticate the Zapier CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @rajapri28613 for their contribution! {shell-plugins#337}
• Authenticate the Vertica CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @parthiv11 for their contribution! {shell-plugins#327}
• Authenticate the Yugabyte CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @parthiv11 for their contribution! {shell-plugins#322}
• Authenticate the Upstash CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @siddhikhapare for their contribution! {shell-plugins#316}
• Authenticate the Civo CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @itsCheithanya for their contribution! {shell-plugins#296}
• Authenticate the MongoDB Atlas CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @joqim for their contribution! {shell-plugins#198}
• Authenticate the Flyctl CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @arunsathiya for their contribution! {shell-plugins#141}

Improvements

• Help text for many commands is now simpler and uses active voice. {3676, 3768}
• `op read` help text now includes example for using `ssh-format` query parameter to get an SSH key's private key. {3795}
• Added a note to `op run` help text to explain access and option to use service accounts. {3804}
• Error messages in `op item create` and when provisioning actions fail are now more clear. {3263, 3766}
• `op whoami` for service accounts no longer asks to authenticate the service account token. Instead, it does it automatically. {3744}
• PostgreSQL plugin now also supports `pgcli` as an alternative to psql. Thanks to @szymon for their contribution! {shell-plugins#384}
• The Cachix plugin now checks for the `~/.config/cachix/cachix.dhall` file and attempts to import an auth token using the specified file. Thanks to @dethancosta for their contribution! {shell-plugins#373}
• The Sentry CLI plugin now skips authentication when the `--auth-token` and `--api-key` are specified. Thanks to @roy9495 for their contribution! {shell-plugins#370}
• The Homebrew shell plugin now provides authentication for the `upgrade`, `update`, `install` and `reinstall` commands. Thanks to @cullenmcdermott for their contribution! {shell-plugins#369}
• The Sentry Plugin now has support for `SENTRY_PROJECT` & `SENTRY_URL`. Thanks to @JoeKarow for their contribution! {shell-plugins#363}
• The PostgreSQL plugin now also supports the `pg_dump` and `pg_restore` CLI utilities. Thanks to @JoeKarow for their contribution! {shell-plugins#353}
• OpenAI now has updated docs and management URLs. Thanks to @arunsathiya for their contribution! {shell-plugins#351}
• When generating the plugin template, set only the last word of the credential name as the default 1Password field name, if it's longer than seven characters. Thanks to @arunsathiya for their contribution! {shell-plugins#263}
• The ngrok plugin now specifies the correct credential length. {shell-plugins#250}
• The ngrok plugin now uses envvars in ngrok version 3.2.1 and higher. Thanks to @arunsathiya for their contribution! {shell-plugins#222}

Fixed

• Bring back deprecated JSON keys for `op whoami` output for service account for backwards-compatibility. {3754}
• `op whoami` throws the appropriate error if an invalid service account token is set. {3744}
• When searching for an item by title and vault where the title is 26 characters long, the item will now be returned. {3751}
• `op vault list` now only returns vaults the account has read access to. {3688}

2.21.0 (build #2210002)

This release introduces SSH Key item creation through 1Password CLI, and improves the help text of some of the commands.

New

• SSH keys can now be generated with the `op item create --category ssh` command. {3736}
• The CLI can now be installed at any location and the desktop app integration will work as long as the latest version is being used. {3713}

Improvements

• `op`, `op signin` and `op account add` help text is now simpler and less verbose. {3676}

2.20.0 (build #2200001)

This release introduces the new `op item move` command and includes improvements to secret references, `op whoami`, and some item management commands. Note: JSON keys `URL` and `ServiceAccountType` have been removed from the `op whoami` JSON response for service accounts. Either switch to using `url` and `user_type`, respectively, or update the CLI to version 2.22.0 or later which brings these keys back for backwards-compatibility.

New

• Secret references now support retrieving attributes of an item field, such as MFA codes and SSH private key formats, using query parameters . {3691}
• `op item move` moves an item between vaults. {3698}

Improvements

• When retrieving items of type SSH key, the private key is displayed in OpenSSH format. {2843}
• Items created using the shell plugins' importers now also contain the plugin's management URL. {3628}
• The CLI now shows shell plugin setup instructions when no installed plugins are detected. {3208}
• The CLI will not prompt to authorize if there are no secret references in the environment. {3695}
• `op whoami` output for service accounts (both human readable and JSON) is now on par with the output for regular users. {3482}
• `op whoami` now tells the user if the service account is authenticated or not. {3482}
• It's now possible to create a favorite item with `op item create`. {3704}
• It's now possible to update an item's favorite status with `op item edit`. {3704}

Fixed

• There is no longer an error returned for shell plugins initialized before version 2.19.0. {3664}
• Addressed a rare case where a secret would not correctly be masked by the "op run" command. {3500}
• Using a 26-character long item title no longer results in an error when retrieving the item. {3523}
• 1Password CLI no longer crashes when an invalid service account token is provided. {3591}
• `op whoami` JSON output for service account now has the keys in snake_case, matching the rest of the CLI JSON output. {3482}

2.19.0 (build #2190004)

This release introduces two new shell plugins and two new executables for the OpenAI plugin. It also brings several improvements and fixes to the AWS and GitHub shell plugins, as well as to the CLI.

New

• Authenticate the Oh Dear CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @owenvoke for their contribution! {shell-plugins#269}
• Executables "oaieval" and "oaievalset" are now supported within the OpenAI shell plugin. {shell-plugins#208}
• Authenticate the Vercel CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @j178 for their contribution! {shell-plugins#273}

Improvements

• `op plugin clear` more clearly displays credentials which are about to be cleared. {3560}
• AWS shell plugin now supports sourcing credentials from another profile. {shell-plugins#299}
• GitHub shell plugin skips authentication if it runs with shell completion flag `__complete`. Thanks to @j178 for their contribution! {shell-plugins#271}
• Shell plugin help text now references plugin-executable instead of plugin-name for clarity. {3361}

Fixed

• 1Password CLI will no longer return a "received unexpected response from 1Password app" for the first command that is executed when the 1Password app is locked. {3568}
• A typo in the `op whoami` help text has been fixed. {3646}
• AWS Shell Plugin no longer outputs aws-vault specific logs. {shell-plugins#297}
• AWS shell plugin no longer creates an `.aws/config` file when using the aws-vault importer. {shell-plugins#259}

2.18.0 (build #2180001)

Introducing automated secrets management with 1Password Service Accounts! 🚀

1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional services. Seamlessly integrate secrets management into CI/CD pipelines like GitHub Actions, CircleCI, and Jenkins. Service accounts are ideal for shared environments because they provide an authentication method for 1Password CLI that isn't associated with an individual. You control which vaults are accessible and which actions the service account can perform.

We’d like to give a huge shout-out to all awesome beta testers. Throughout the past months, you've helped us tremendously by letting us in on your daily workflows, filing bug reports, suggesting improvements and helping us shape 1Password Service Accounts into the product that we're releasing today. You are all amazing! 🎉

Check out all the features of 1Password Service accounts and learn more about automating secrets management in the 1Password developer documentation!

New

• Users can now authenticate with the CLI using 1Password Service Accounts.

Fixed

• Users can now create items of custom categories by providing a template. {3483}
• Executing `op plugin run` with a plugin that has not yet been configured no longer exits after the configuration steps. {3537}

2.17.0 (build #2170001)

This release introduces several new shell plugins and additions to existing plugins. Moreover, some improvements and fixes are brought to the CLI.

New

• Authenticate the Akamai CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @wongle for their contribution! {shell-plugins#234}
• Authenticate the Laravel Vapor CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @andresayej for their contribution! {shell-plugins#245}
• Authenticate the Laravel Forge CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @andresayej for their contribution! {shell-plugins#244}
• Authenticate the Pulumi CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @ringods for their contribution! {shell-plugins#199}
• Authenticate the Zendesk CLI using Touch ID and other unlock options with 1Password Shell Plugins. {shell-plugins#207}
• AWS credentials stored in aws-vault can now be imported into 1Password. {shell-plugins#229}
• Authenticate the AWS CDK CLI using Touch ID and other unlock options with 1Password Shell Plugins. {shell-plugins#232}
• Assuming AWS roles and profiles is now supported with the AWS shell plugin. {shell-plugins#180}

Improvements

• A deleted/restricted user that last updated an item will be displayed by name when running `op item get`. {3394}
• An error is thrown if a document is created/updated from the CLI through standard input but no content is provided. {2624}
• A description was added about configuring the CLI to use Connect / Service Account if no account is configured, in the help text of `op signin`. {3396}
• Users attempting to create new DOCUMENT items with Connect will now receive a friendlier error message. {3127}

Fixed

• The `--config` and `--session` flags are now fully supported for `op plugin` and `op whoami` commands respectively. {3423}
• Typos in the help-text of `document create` and `document edit` concerning the misspelling of the `--file-name` flag have been corrected. {3432}

2.16.1 (build #2160101)

This release fixes two shell plugins and brings improvements to newly-added functionality.

Improvements

• The help text for op events-api now specifies that Events Reporting is only available for business accounts. {3453}
• When initializing the SourceGraph shell plugin an appropriate management url will be displayed. {shell-plugins#228}

Fixed

• Treasure Data shell plugin no longer returns an error during the init step, as its executable now correctly references its API Key credential. {shell-plugins#225}
• When initializing the Gitea plugin, it now also checks the default configuration directory on MacOS to find a credential to import. Thanks to @mcornick for their contribution! {shell-plugins#219}

2.16.0 (build #2160001)

This release introduces a new Events API feature, as well as two new shell plugins. Additionally, it contains fixes and improvements to 1Password CLI and shell plugins.

New

• The default features list when creating new Events API tokens will now include Audit Events, in addition to Sign-In Attempts and Item Usages. {3146}
• Authenticate Gitea CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @14zombies for their contribution! {shell-plugins#205}
• Authenticate Treasure Data CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @Lewuathe for their contribution! {shell-plugins#176}

Improvements

• `ngrok` is now aware of the `--config` flag and of any existing config files in the default location on the user's filesystem. {shell-plugins#194}
• The HomeBrew shell plugin now skips authentication for the `bump` sub-command as well. Thanks to @MTCoster for their contribution! {shell-plugins#179}
• The `--output` flag of `op document get` is now doubled by `--out-file`, for consistency with other commands. {2960}
• To help with determining the 1Password item to use for a shell plugin, additional item metadata is now shown in the selection prompt. {3180}
• Shell plugins credential fields can now be identified by more than one name. {3386}
• `document get` now outputs the absolute file path on a successful file write and prompts to overwrite if the file already exists. {3383}

Fixed

• Connect tokens with no vault access permissions can no longer be created using the 1Password CLI. {3167}
• Item count is now present in the JSON output of empty vaults' details. {2995}
• `UpdatedAt` and `ItemCount` attributes are now consistently up to date in the cached vaults. {3373}
• Item version is now up to date in the output of `op item create` and `op item edit`. {3387}
• Connect tokens can now be created when passing the `--vault` flag with the `op connect token create`. {3290}
• Items are now successfully returned by `op item get` even if they were last edited by a deleted or restricted user. {3394}
• The CLI will no longer silently succeed if the piped input is not handled properly. {3378}
• Item lookup by name will no longer fail when resource name is alphanumeric of length 26. {2614}

2.14.0 (build #2140001)

This release introduces five new shell plugins as well as improved error messages around shell plugin local builds and CLI command help text.

Shout-out to @arunsathiya from the community for their plugin contributions to this release! 💚

New

• Authenticate ngrok using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @arunsathiya for their contribution! {shell-plugins#165}
• Authenticate Vultr CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @arunsathiya for their contribution! {shell-plugins#159}
• Authenticate Snowflake CLI using Touch ID and other unlock options with 1Password Shell Plugins. {shell-plugins#161}
• Authenticate Fastly CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @arunsathiya for their contribution! {shell-plugins#169}
• Authenticate Sourcegraph CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @arunsathiya for their contribution! {shell-plugins#146}

Improvements

• The AWS Shell Plugin now checks if the AWS_SHARED_CREDENTIALS_FILE environment variable is set and attempts to import credentials using the specified file. Thanks to @Volatus for their contribution! {shell-plugins#178}
• Error messages for shell plugin local builds now include link to troubleshooting documentation. {3286}
• Help text formatting is now more consistent across commands. {3343}
• op item help text now shows correct command for getting item category templates. {3358}

2.13.1 (build #2130101)

This release introduces four new shell plugins, as well as two importers. It also contains some improvements and fixes brought to the CLI commands and to the shell plugins' cache.

In addition, this release fixes a bug introduced in 2.13.0, where the Windows binaries were not code-signed.

Shout-out to @bsamseth, @ssttehrani and @alexclst from the community for their contributions to this release! 💚

New

• Authenticate the Cargo CLI using Touch ID and other unlock options with 1Password Shell Plugins. {shell-plugins#139}
• Authenticate the Argo CD CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @ssttehrani for their contribution! {shell-plugins#145}
• Authenticate the Databricks CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @bsamseth for their contribution! {shell-plugins#143}
• Authenticate the OpenAI CLI using Touch ID and other unlock options with 1Password Shell Plugins. {shell-plugins#152}
• `op update` now allows you to look for updates from a specific channel via the `--channel` flag. {1648}

Improvements

• Twilio CLI credentials can now be imported from the `~/.twilio-cli/config.json` config file. {shell-plugins#112}
• Linode CLI credentials can now be imported from the `~/.config/linode-cli` config file. Thanks to @alexclst for their contribution! {shell-plugins#113}
• Shell plugins now throw an error if a configured item is archived. {3232}
• When importing shell plugin credentials and prompting for a vault to store them in, 1Password CLI will only show vault names if all vaults have distinct names. {3244}
• The AWS, CircleCI, DigitalOcean, Fossa, GitHub, GitLab, Heroku and Okta plugins no longer unnecessarily prompt for authorization when no arguments are provided to the commands. {shell-plugins#126}
• The Homebrew and ReadMe plugins no longer unnecessarily prompt for authorization for 'help' or 'version' related commands. {shell-plugins#126}

Fixed

• `--vault` flag for `op item edit` now has the appropriate description. {3273}
• Plugin cache no longer breaks when caching certain credentials. {3295}
• Code signing for 1Password CLI binaries for Windows has been fixed. {3347}
• Connecting 1Password CLI with the 1Password app for Windows is now again possible. {3347}

2.12.0 (build #2120001)

This release introduces three new Shell Plugins!

Shout-out to @shyim and @kanadgupta from the community for their plugin contributions to this release! 💚

New

• Authenticate the ReadMe CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @kanadgupta for their contribution! {shell-plugins#106}
• Authenticate the Hcloud CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @shyim for their contribution! {shell-plugins#87}
• Authenticate the Cloudflare Workers using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @shyim for their contribution! {shell-plugins#94}

2.11.0 (build #2110001)

This release introduces two new Shell Plugins, as well as a few bug fixes for the Shell Plugins contribution beta.

Additionally, this release also fixes a CLI bug that intermittently causes `panic`s on Windows.

Shout-out to @markdorison and @micnncim from the community for their plugin contributions to this release, as well as to @shyim for bringing a Shell Plugins bug to our attention! 💚

New

• Authenticate the Homebrew package manager using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @markdorison for their contribution! {shell-plugins#110}
• Authenticate the Cachix CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @micnncim for their contribution! {shell-plugins#97}

Improvements

• Shell plugin commands will now error, or show a warning in the case of `op plugin list`, if any incompatible local plugins are detected. {3196}

Fixed

• Errors that were encountered sporadically on repeated use of CLI on Windows when 1Password CLI is connected to the 1Password app are no longer returned. {2611}
• Locally built plugins with the CredentialUsage.Provisioner field set no longer crash. {3262}
• Locally built plugins no longer fail when using cache or additional command flags due to incomplete `ProvisionOutput` sent as response to RPC calls. {3276, shell-plugins#103}

2.10.0 (build #2100003)

This release introduces three new plugins and four new importers, as well as support for the Fish shell for 1Password Shell Plugins.

Shout-out to @markdorison, @alexclst and @colinbarr from the community for their contributions to this release! 💚

New

• Authenticate the Tugboat CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @markdorison for their contribution! {shell-plugins#85}
• Authenticate the Linode CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @alexclst for their contribution! {shell-plugins#86}
• Authenticate the Lacework CLI using Touch ID and other unlock options with 1Password Shell Plugins. Thanks to @colinbarr for their contribution! {shell-plugins#95}
• Shell plugins can now be used with Fish shell. {3264}

Improvements

• 'op plugin init' and 'op plugin run' will now return a warning or an error if the plugin's CLI cannot be found in $PATH. {3230}
• Datadog credentials can now be imported from the `.dogrc` config file. {shell-plugins#101}
• Snyk credentials can now be imported from the `snyk.json` config file. {shell-plugins#82}
• Sentry CLI credentials can now be imported from the `.sentryclirc` config file. {shell-plugins#99}
• Github Personal Access Tokens can now be imported from the `gh/hosts.yml` config file. {shell-plugins#74}

2.9.1 (build #2090101)

This patch release fixes the use of the MySQL plugin.

Fixed

• Using the MySQL Shell Plugin no longer throws the 'unknown option `--defaults-file`' error. {3259}

2.9.0 (build #2090001)

Welcome to the world of 1Password Shell Plugins! 🚀

Shell Plugins takes the Touch ID and other unlock options you're used to from 1Password CLI and makes them available for every CLI under the sun. ☀️ You can store your API credentials encrypted in 1Password and load them just when you use a CLI, so you never have to store your credentials in plaintext on disk.

We’d like to give a huge shout out to all our awesome beta testers. Throughout the past months, you have helped us tremendously by letting us in on your daily workflows, filing bug reports, suggesting improvements and shaping 1Password Shell Plugins together with us into the product that we are releasing today. You are all amazing! 🎉

Check out all the features of 1Password Shell Plugins and learn more about automating your local workflows in the 1Password developer documentation!

New

• Authenticate CLIs for AWS, CircleCI, DigitalOcean, DogShell, FOSSA, GitHub, GitLab, HashiCorp Vault, Heroku, Okta, PostgreSQL, Sentry, Snyk, Stripe and Twilio using Touch ID and other unlock options with 1Password Shell Plugins.

2.8.0 (build #2080013)

This release brings improvements to the command usage and user operations with the 1Password CLI.

Improvements

• The global flags will now only be listed in the root command's help text. {3215}
• User provisioning and confirmation operations are more performant. {3087,3137}

2.7.3 (build #2070301)

This release contains improvements and fixes related to shell plugins, modifications to our help-text and a security fix.

Improvements

• Usage help-text and error messages now use "Connect with 1Password CLI" as the name of the integration setting. {2628}

Security

• Resolved an issue where malicious vault items could override environment variables on Windows. Credits to security researcher RyotaK and the Go security team.

2.7.2 (build #2070202)

This release contains improvements and fixes brought to commands' usage, output and help text.

Improvements

• `op signin` help text now notes that users are only prompted to authenticate if not already authenticated. {2824}
• Management commands now work with their plural form as well (e.g. `op items list`). {1566}
• Information about the `op read` command is now included in the help text for `op item get`. {2830}
• Listing connect tokens now shows the IntegrationId instead of the issuer. {1663}
• `op user provision` help-text now uses the word "administrator" rather than "admin". {2745}
• `op user get` help text examples now use `--public-key` flag instead of `--publickey`. {2922}

Fixed

• TRANSFER_SUSPENDED is now accurately reflected in `op user get`. {2704}
• It's no longer possible to create a vault with no name. {2855}
• Displayed vault details are now consistently up to date for cached vaults. {2829}

2.7.1 (build #2070101)

This release contains a series of fixes for a few issues our customers brought to our attention. Thank you everyone for your involvement.

Improvements

• The help text for `op group user` commands now uses simpler language to describe membership. {2687}

Fixed

• An error message prompting the user to sign in again is displayed instead of panic when no credentials are available. {2697}
• `op vault create --help` now shows the correct default value for the `--allow-admins-to-manage` flag. {2645}
• Fixed an issue on Windows where the CLI would return "The system cannot find the file specified" when using biometric unlock in some rare cases. {2806}
• Piping multiple items into `op item create` does no longer trigger an Internal Conflict Server Error. {2808}

2.7.0 (build #2070002)

This release prepares support for sharing SSH items and allows for default values to be specified for template variables used in secret references in either `op inject` or `op run`.

Improvements

• Default values for template variables can now be specified in environment files used with `op run` and in configuration files used with `op inject`. {2307}
• Prepare support for sharing SSH items. After support is added on 1password.com, item-sharing for SSH keys will work from this version onwards. {2700}

2.6.2 (build #2060201)

This patch release fixes a bug related to using `op item create` in scripts.

Improvements

• Items that are retrieved from the built-in cache now have their usage reported in the Usage Report. {2021}

Fixed

• `op item create` no longer freezes in certain scripts, when called without piped input. {2703}

2.6.1 (build #2060102)

In this release we have a few quality of life improvements, bugfixes, and a significant cache optimization. Also, beta users who wish to use a Docker image can pull the `2-beta` tag to retrieve the latest v2 beta images.

New

• 1Password CLI beta release images are published to Docker Hub. {2664}

Improvements

• Item caching logic has been optimized. {2662}
• `op item list --favorite` now only lists favorite items. {1837}
• Creating new Connect servers in a directory in which 1password-credential.json already exists now prompts to confirm a file overwrite. {2220}
• Help text examples now show Powershell versions when you use 1Password CLI on Windows. {2581}
• The CLI reference overview documentation now notes that the cache is enabled by default on UNIX-like systems. {2621}
• `op group user revoke` help text is now up to date with 1Password CLI 2. {2686}

Fixed

• Provisioned users who were suspended can now be deleted. {2563}
• 1Password CLI binaries in Docker images show the correct version. {2671}
• Debian beta package version metadata correctly reflects that it is a beta. {2660}

2.6.0 (build #2060007)

This release mostly contains optimisations pertaining to the CLI's caching, as well as improvements and fixes related to file handling.

Improvements

• The file of a Document-type item can now be referenced using the 1Password CLI secret referencing syntax. {2118}
• Optimize commands that involve retrieving multiple fields (eg. 'op run', 'op inject'). {2557}
• Cache is enabled by default, it can be disabled by setting the `OP_CACHE` env var to `false`, or by specifying the `--cache=false` flag. {2589}
• `op --help` now contains documentation related to the default caching between commands. {2589}
• The help text example for concatenating secrets with op inject now uses db_url consistently. {2522}
• `op read` help text now notes that whitespaces are supported, require quotation marks. {2522}

Fixed

• User timestamp fields are omitted instead of shown as year 1 if they are not returned in the server response. {2435}
• The cache daemon process no longer holds the current directory in use. {2485}
• Vault items are cached more reliably and efficiently when the `--cache` flag is enabled. {2540}
• The name of file-type fields is again visible in json and human-readable item representations. {2616}
• The file-type fields now have the correct ID in the json and human-readable output of items. {2625}

2.5.1 (build #2050101)

This release contains a bugfix.

Fixed

• Using biometric unlock on macOS should no longer return the error "connecting to desktop app: determining parent process of" in some rare cases. {2544}

2.5.0 (build #2050001)

This release mainly contains fixes centered around file-handling with the CLI, as well as our Connect client. An exhaustive list of additions, improvements and fixes can be found below.

New

• `op item create/edit` can now handle file attachments to items. {2141}

Improvements

• A debug message is now logged if the state of CLI biometric unlock in the 1Password app cannot be determined. {2167}
• An error is now thrown when `op document get` tries to print a file containing unprintable characters. {2288}
• `op item list` returns more descriptive error messages when it times out. {2371}
• The CLI reference overview documentation now includes a learn more section, various style updates. {2386}
• Debug messages are printed to stderr instead of stdout. {2167}
• The correct ID and secret references are now displayed for file-type item fields in the json output of items. {2524}
• `op item get` leverages the vault in its piped input, in order to improve performance for these use-cases. {2211}
• A friendlier error is returned if the local session file is corrupt. {2459}
• A clearer error is displayed when trying to read a file field that has not finished uploading. {2539}

Fixed

• Debug messages are only printed if the --debug flag is used. {2167}
• Secret references that match more than one secret now return an error instead of returning the first match when using the CLI with Connect. {2525}
• Addressed a problem where upgrading from a CLI version lower than v2.3.1 could lead to an error for the first 10 minutes after updating. {2459}
• Fields and files can now be consistently referenced using the 1Password Secret Referencing Syntax, when using a Connect backend. {2541}

2.4.1 (build #2040101)

This patch release addresses some of the issues that have been brought to our attention by our users. We want to thank the 1Password community for raising these, and for helping us quickly identify and fix them.

Improvements

• It is now possible to specify the vault of an item on creation through the JSON template or piped input. {2460}
• Mentions of `--cache` now note that the cache is not available on Windows. {2447}

Fixed

• `op user edit --name NAME` command now correctly updates the user's name. {2501}
• Categories containing multiple tokens in their name are not invalidated anymore, when specified in json template/piped input in op item create. {2515}

2.4.0 (build #2040002)

This release contains improvements and fixes over the CLI's piped input handling. The help-text and some user-facing errors have also been improved. To boot, a new command to retrieve information about currently ongoing sessions has been added.

New

• The `op whoami` command now allows retrieving information about the currently ongoing sessions. {2218}

Improvements

• You can now pipe json input to the CLI commands without explicitly passing the "-" argument placeholder. {2216}
• Successfully granting a Connect server access to a vault prints a completion message. {2210}
• A more descriptive error message is returned when `op item get` is called without the vault flag when used with a Connect backend. {2475}

Fixed

• Piping now works with `op connect server get`, `op connect server delete` and `op connect token delete`. {2216}
• The Connect server UUIDs corresponding to the listed tokens now show up in the json output of `op connect token list`. {2216}
• `op item create` now interprets the `--category` flag as expected when items are piped via stdin or passed via template files. {2464}
• `op document create` help-text example now uses CLI 2 syntax. {2427}

2.3.1 (build #2030101)

This patch release contains two fixes for regressions introduced in 2.3.0. We want to thank the 1Password CLI community for raising these issues to us, and helping us quickly identify and fix them.

Improvements

• A more suggestive error is returned when trying to grant access for Connect to a Private/Personal vault. {2212}
• Secret references are now printed in the json output of `op item create/edit` commands. {2387}

Fixed

• `op item get` no longer returns an error when `--include-archive` is not specified and Connect is configured. {2476}
• When querying values of fields with identical names within different sections of an item using a Connect server, 1Password CLI now returns the expected value. {2477}

Security

• Strengthen key derivation for sessions established using biometric unlock by adding a salt. {2062}

2.3.0 (build #2030001)

In this release, we have a mix of new features, quality-of-life improvements, bugfixes, and security updates.

Improvements

• The public key, fingerprint, and key type fields of an SSH Key item are included in `op item get` output and secret references. {2341}
• The 'Additional Information' field from the human-readable representation of items has been removed. {2369}
• The output `op vault list` is sorted alphabetically. {2437}
• The cache can also be enabled by setting the `OP_CACHE` environment variable to true. {2372}
• A clearer error is returned if the CLI is not installed correctly on macOS for biometric unlock to work. {2202}
• The help text example for retrieving a one-time password in `op item get` uses the `--otp` flag. {2358}

Fixed

• The CLI should no longer return erroneous fields when there are more than one field with the same ID in an item. {2341}
• `op document get` command now prints without adding a new line at the end of its output (a 'linefeed' ASCII character). {2413}
• IDs can be used in secret references when using Connect backend. {2384}
• The vault ID and name are consistently present in the output of `op item create/edit`. {2441, 2179}
• Ensure user properties are correctly populated by getting user object from user API. {2432}

Security

• Improved validation of server parameters in SRP process. Credits to Cure53. {2442}

2.2.0 (build #2020001)

This release mainly contains some improvements around the CLI's help-text, as well as adds the possibility to pipe via stdin when creating items.

Improvements

• `op connect token create` help-text example now uses CLI 2 syntax. {2292}
• `op connect` help-text now clarifies vault limitations. {2330}
• `op connect token create` has improved help text, and now takes a `--vault` flag instead of `--vaults` to clarify that multiple `--vault` flags can be set. {2329}
• `op item create` now accepts JSON input on stdin. {2425}

2.1.0 (build #2010001)

In this release, we've added a feature to include item fields' secret references as part of an item's JSON output.

New

• JSON item output now shows valid secret references for all fields. {2100,2361}

Improvements

• When using `op account add` for a shorthand that already exists, the shorthand is now displayed with the suggested `op account forget` command. {1051}

2.0.2 (build #2000201)

This release contains a small fix and improvements to the usage help-text.

Improvements

• When signing in with duplicate accounts a more descriptive message is shown. {1051}
• Item types available in item create and item get are cleared up in the usage text. {2272}
• The help text for `op item get` is now more clear about the intended output when retrieving fields using the `--fields` flag. {2306}

Fixed

• The usage of `op read` no longer contains the reference argument twice. {2261}
• Escape sequences in the output of `op run` are no longer escaped. {2331}

2.0.1 (build #2000102)

This release contains fixes and improvements that have been suggested by customers for the 2.0.0 CLI. Additionally, it includes security improvements made after a security audit by Secfault Security.

New

• Added support for OTP field type for inline item assignments. {1647}

Improvements

• All links to related developer documentation articles now point to the new URLs. {2069}
• `op account add` help text now notes that biometric unlock requires 1Password 8. {2099}
• `op completion` help text now has instructions for loading completion information for PowerShell. {2068}
• `UUIDs` are now referred to as `IDs` throughout help text. {2136}
• JSON item output now includes the vault's name the item is from. {2100}
• Errors are clearer when reading/creating config file fails. {2062,2095}
• CLI now throws an error when a command doesn't work with Connect and Connect specific environment variables are set. {2046}
• `op item template get` no longer shows an empty vault key for the item. {2169}
• Subcommands in the help text now follow the CRUDL order. {2058}
• The user ID in the output of `op account list` is now referred to as such, instead of user UUID. {2136}
• op user provision help text is now more clear. {2159}
• Revoking user access from the Team Members group returns a more descriptive error message. {1553}
• When adding a new account, you can now supply your user's secret key with the `OP_SECRET_KEY` environment variable. This is the new recommended method to add accounts on systems where we cannot prompt you for the secret key. Credits to Secfault Security. {2185}
• The `op` binary from the Docker Image is now statically compiled, and works well with Alpine Docker images. {1694}
• The list output for vaults, items and accounts now contains more details in its json format. {2192}
• op events-api help text now notes business or team account requirements. {2271}
• op item template list now uses new syntax for op item template get example. {2265}
• Events API naming is now standardized in help text. {2269}
• .env files that are used with `op run` can now contain and refer to environment variables that contain linebreaks. {2086}
• Parsing of .env files for `op run` is now more robust. Credits to Secfault Security for pointing out a parsing inconsistency. {2182}

Fixed

• Fields called `title`, `url` and `tags` now take priority over the built-in attributes, with `op read`, `op run` and `op inject`. {2059}
• The output of `op signin` now correctly mentions that `op signin` uses the `--account` flag instead of an argument. {2089}
• Address fields are now properly displayed instead of being empty. {2063}
• Addressed a rare case where running a CLI command with biometric unlock enabled consistently results in an "SRP-x unsupported length" error. {2193}
• Windows signature file `op.exe.sig` returns to the Windows download archive. {2180}
• `op connect vault grant` and `op connect vault revoke` now return an error if you are missing permissions to perform the action. {2213}
• Example for document get now uses CLI 2 syntax. {2145}
• Providing raw text as piped input into `op inject` now outputs an appropriate error message. {2178}
• Date and MonthYear field types are now properly parsed when the item JSON template is provided to create an item. {2075}
• The `pkg-version` for the 1Password CLI on macOS now returns the correct version. {2120}
• Debian packages for 32-bit arm systems are packaged under the correct architecture name (armhf). {2186}
• Addressed an issue where you could get a persistent "You are not currently signed in" even after signing in. {2293}

Security

• Replaced backticks in help text and error messages with single quotes. {2112}
• Improved the signature verification of the 1Password app when using biometric unlock on Windows. Credits to Secfault Security. {2143}
• Filtering of `op` specific environment variables has been removed from `op run`, as no security advantages are obtained by this filtering. Credits to Secfault Security. {2184}
• Fixed a race-condition that could result in a file written by the CLI to not end up with the specified filemode. Credits to Secfault Security. {2198}
• The CLI refuses to write to files that are symlinked. Credits to Secfault Security. {2198}
• Unprintable characters are now filtered out from the output of the CLI, when used interactively. Credits to Secfault Security. {2183}

2.0.0 (build #2000019)

This is the first release of the next generation of 1Password CLI! 🚀

It takes the usability and accessibility that you're used to from 1Password to the terminal. Among others, it allows you to unlock the CLI using biometrics, and has a new and improved command structure and output.

In addition, we also introduced some brand new functionality to 1Password CLI. Some of the features we'd like to highlight are Psst! support and the ability to securely load secrets into scripts, applications, and other workloads.

We would like to shout out our amazing early access community for raising bug reports, suggesting improvements, and helping us shape the 1Password CLI along every iteration of the beta into the product we are now releasing! 🎉

Check out all the improvements and new features below and learn more in our new developer documentation!

New

• 1Password CLI 2 now uses a new command schema, together with a more intuitive JSON output format.
• Biometric Unlock can now be used instead of typing your account password on the command line. {1943}
• Loading secrets into configuration files, environment variables and key-files is now possible with the inject, run and read commands, respectively. {1577}
• The item get, inject, run and read commands now also support using a Connect server. Use it by setting OP_CONNECT_HOST and OP_CONNECT_TOKEN environment variables. {1580}
• Now you can securely share items with anyone - even if the recipient doesn't use 1Password - using op item share. {1650}
• 1Password CLI can now be installed via apt, dnf and apk.
• All commands now format their output in a new human friendly format. Use the --format=json flag or OP_FORMAT=json environment variable to output as JSON. {1487, 1564}

Improvements

• Vault access permissions can now be granted and revoked granularly when managing users' and groups' access to vaults by specifying --permissions. {1517}
• Listing groups or users that have access to a vault now displays the group's or user's permissions. {1608}
• Granting or revoking vault permissions prints the resulting permissions. {1739}
• Setting whether a vault is safe for travel can be achieved with the --travel-mode flag, while editing vaults. {1505}
• Deleting multiple vaults at once is now possible. {1505}
• When getting items, you can now retrieve fields by field type. {1855}
• Creating and editing items now have a dry-run feature, which prints the resulting items without saving them. {1515}
• When editing items, you can now change the autofill url, tags and title. {1506}
• Creating items can now be done using templates similar in format to the items retrieved with 1Password CLI. The old format is no longer supported. Support for passing in base64 encoded templates as an argument has been removed. {1578}
• Creating and editing items now offer support for setting, updating and deleting fields through command line arguments. {1515}
• Saving item templates to a file is now possible. {1636}
• Curly brackets are no longer shown around vault IDs when listing items. {1632}
• Selecting items by tags now retrieves nested tags. {1529}
• Setting the --tags flag to an empty value while editing items or documents will now remove all tags. {1558}
• Tags specified multiple times on commands to create or edit items or documents are now applied only once. {1598}
• Adding new accounts is now done using a standalone command, op account add. Configuring new accounts via op signin is no longer supported. {1898}
• op signin accepts the --account flag to select which account to sign in to. The command no longer supports arguments. {1898}
• $OP_ACCOUNT and --account flag now also accept a user UUID or an account UUID. {1900}
• The --list flag of op signin has been removed, and the functionality has been moved to op account list. {1881}
• Listing accounts no longer returns DSECRET and SECRET_KEY in its output. {1748}
• Forgetting all authenticated accounts at once is now possible. {1504}
• Confirming multiple users of an account at once is now possible. {1502}
• Deleting multiple users from an account at once is now possible. {1502}
• Editing multiple users within an account at once is now possible. {1502}
• Reactivating multiple users within an account at once is now possible. {1502}
• Suspending multiple users within an account at once is now possible. {1502}
• You can now output debug logs using the binary flag --debug or the environment variable OP_DEBUG. Currently debug logs exist for biometric unlock only. {1910}
• --iso-timestamps can now also be set using the $OP_ISO_TIMESTAMPS environment variable. {1926}
• The --include-archive flag can now also be specified setting the OP_INCLUDE_ARCHIVE environment variable to true. {1616}
• The formatting and phrasing of error messages has been improved. {1871}
• The help text across 1Password CLI commands is now clearer, more elaborate and better formatted. {1736}
• 1Password CLI now has completion support for fish shell. {2056}
• list and delete commands can now be used with their aliases: ls, remove and rm. {1571}
• Listing events is no longer possible. Please continue using 1Password CLI version 1 to read audit events. Before support for version 1 ends, a more sophisticated solution for audit events will be available. {1710}
• armv7 and arm64 Docker images of 1Password CLI are now being built and published on DockerHub. {1771}
• When granting a user access to a group, passing the role via the --role flag is now case insensitive. {1752}
• Editing groups or vaults now supports clearing the description with --description="". {1544}

Fixed

• Retrieving accounts now returns the correct account type for Team accounts. {2008}
• op update now works on MacOS too. {1717}
• Granting users permission to a vault consistently works as expected. {1730}
• Confirming users within an account now properly confirms individual users. {1751}
• Listing group permissions to a vault displays the correct permissions based on the account’s tier. {1517}