All tools

1Password

Password manager with service accounts and a CLI for secrets

My rating4.5
Individual from $3.99/mo, Families $5.99/mo, Teams Starter $24.95/mo for 10, Business $8.99 per userSubscriptionI pay for it
Get it
Verdict

The only password manager I know that is also a decent secrets store for code.

Pros

  • Service accounts give a script read access to one vault and nothing else
  • The CLI injects secrets into a command at runtime, so nothing lands on disk
  • Shared vaults make handing a contractor one credential painless
  • Browser and SSH agent integration both just work

Cons

  • Service accounts need the vault named on every call, which trips you up for a week
  • The CLI can trigger a keychain prompt in the wrong context and hang a script
  • Pricing is per user, which adds up once a few machines count as people

Best forAnyone who runs scripts that need API keys and is tired of .env files scattered over three machines.

1Password is a password manager that grew a command line. The app does what you expect: logins, cards, notes, shared vaults for a team. The part that earns it a place on this page is the CLI with service accounts, which turns the same vault into a secrets store your scripts can read.

How I use it

Every API key I own lives in a vault. A script that needs one does not read a file; it asks the CLI at runtime, with a service account token that can see exactly one vault and nothing else. The upshot is that none of my repositories contain a secret, and a new machine is set up by pasting one token into the shell profile. When I rotate a key, I change it in one place and every script picks it up on the next run.

What surprised me is how well the SSH agent works. Keys live in the vault, the agent serves them, and a new laptop can push to GitHub ten minutes after unboxing. What annoys me are two small things that cost real time. Service accounts must name the vault on every call, and a command that worked for my personal account silently fails for the service account until you add the flag. And the CLI will sometimes reach for the macOS keychain when a script runs headless, and then the script hangs waiting for a prompt nobody will see. You learn to route around both, but you learn it the hard way.

The per-user pricing is fair for humans and slightly annoying once you have machines that behave like users.

Who it is for

Anyone who writes code that talks to APIs. If you only need a password manager for a browser, the cheaper options are fine and the difference does not matter. If you have ever committed a key by accident, or ever copied a .env file over SSH, this is the fix, and the Individual plan is enough to start. Skip it if you are happy with your current manager and never run scripts; you would be paying for the half you do not use.

Alternatives

BitwardenDoppler