Are the secrets encrypted once they become env vars? I feel like this is a silly question without some context, but somehow 1Password is able to keep them private even if echoing them locally, and I haven't yet figured out how.

hm, it shouldn't be. though just to confirm, do you mean A) you're seeing the encrypted value which is unexpected/undesired, or B) 1password uses a behavior of printing the values encrypted and it would be nice if this also had that behavior?

I can't honestly recall what it was doing except I couldn't echo the vars. Can't remember if they were encrypted or just empty.

Related:

https://1password.community/discussion/141554/use-op-run-to-...

https://developer.1password.com/docs/cli/secrets-environment...

Edit: I could be mistaken as well. It has been about a year since I was working on a related project.

FWIW it’s doing string masking when it finds the raw value. I built https://tryopx.com as I prefer to use 1Password to store all my secrets.

This tool is really awesome - love the fact it has integrations as well!