Use the 1Password Terraform provider

With the 1Password Terraform provider , you can reference, create, or update items in your vaults using a 1Password Connect Server, a 1Password Service Account, or the 1Password desktop app.

Requirements

Connect server
Service account
1Password app

Create a Connect server.

Get started

Connect server
Service account
1Password app

To use the 1Password Terraform provider with a Connect server:

Specify the Connect server token. You can set this value with the OP_CONNECT_TOKEN environment variable or with the connect_token field in the provider configuration.
Specify the Connect server hostname, URL, or IP address. You can set this value with the OP_CONNECT_HOST environment variable or with the connect_url field in the provider configuration.

To use the 1Password Terraform provider with a service account, you’ll need to provide your service account token.You can set this value with the OP_SERVICE_ACCOUNT_TOKEN environment variable or with the service_account_token field in the provider configuration.

First, turn on the “Integrate with 1Password SDKs” setting in the 1Password desktop app. If you don’t see this setting, make sure you’ve installed the beta version of the app.

Mac
Windows
Linux

Open and unlock the 1Password app.
Select your account or collection at the top of the sidebar.
Navigate to Settings > Developer.
Under Developer Integrations, select Integrate with 1Password SDKs.
If you want to authenticate with Touch ID, navigate to Settings > Security, then turn on Unlock using Touch ID.

Then provide your account name or ID in the provider configuration:

Get the name of your 1Password account as it appears at the top of the left sidebar in the 1Password desktop app. Alternatively, you can use 1Password CLI to run op account get to find your account ID.
Set the OP_ACCOUNT environment variable or account in the provider configuration to your account name or ID.

Run a Terraform command that requires authentication, and you’ll be prompted to authenticate in the same way you unlock your 1Password app, like with biometrics or your 1Password account password.

Reference

The following sections contain reference information for the 1Password Terraform provider:

Configuration
Resources
Data sources

Configuration

The 1Password Terraform provider has fields you must set before you can use it with a 1Password Connect server, service account, or the 1Password desktop app. The following table describes each field.

Field	Type	Description	Required
`connect_token`	String	A valid token for the 1Password Connect server. You can also source the value from the `OP_CONNECT_TOKEN` environment variable.	Required if using a Connect server.
`connect_url`	String	The HTTP(s) URL of the 1Password Connect server. You can also source the value from the `OP_CONNECT_HOST` environment variable.	Required if using a Connect server.
`service_account_token`	String	A valid token for the 1Password Service Account. You can also source the value from the `OP_SERVICE_ACCOUNT_TOKEN` environment variable.	Required if using a service account.
`account`	String	The 1Password account name as it appears at the top left of the sidebar in the 1Password desktop app. Alternatively, the 1Password account ID. You can also source the value from the `ACCOUNT` environment variable.	Required if using the 1Password desktop app integration.

You can use the following environment variables to specify configuration values.

Environment variable	Description	Configuration field
`OP_CONNECT_TOKEN`	A valid token for the 1Password Connect server.	`connect_token`
`OP_CONNECT_HOST`	The hostname, IP address, or URL of the 1Password Connect server.	`connect_url`
`OP_SERVICE_ACCOUNT_TOKEN`	A valid token for the 1Password Service Account.	`service_account_token`
`OP_ACCOUNT`	The 1Password account name as it appears at the top left of the sidebar in the 1Password desktop app. Alternatively, the 1Password account ID.	`account`

Configuration examples

The following code blocks show configuration examples.

The following examples use environment variables. Make sure to set the environment variables beforehand or use plain text.

Connect server
Service account
1Password app

The following example shows a provider configuration using a Connect server:

connect-example.tf

provider "onepassword" {
  connect_url                   = "OP_CONNECT_HOST"
  connect_token                 = "OP_CONNECT_TOKEN"
}

The following example shows a provider configuration using a service account:

service-account-example.tf

provider "onepassword" {
  service_account_token = "OP_SERVICE_ACCOUNT_TOKEN"
}

The following example shows a provider configuration using the 1Password desktop app:

1password-account-example.tf

provider "onepassword" {
  account               = "OP_ACCOUNT"
}

Resources

The 1Password Terraform provider has the following resources:

onepassword_item resource

Item resource

The onepassword_item resource represents a 1Password item. You can import a onepassword_item with the following syntax:

terraform import onepassword_item.<item_name> vaults/<vault_uuid>/items/<item_uuid>

Schema

The following tables describe the onepassword_item resource schema.

​Requirements

​Get started

​Reference

​Configuration

​Configuration examples

​Resources

​Item resource

Schema

Requirements

Get started

Reference

Configuration

Configuration examples

Resources

Item resource