[timwis]

But doesn’t that still write the secrets to disk? I thought the point of 1pass CLI was so you could avoid having unencrypted secrets on disk?

[surething]

An alternative is using `direnv` and `.envrc` instead:

export TOKEN=$(op item get 'My Service' --fields label=token --vault workwork)

[moltar]

Why not just use op run? It auto replaces references with values.