Where Does the 1Password CLI Store Config?
The 1Password CLI keeps account config in an op folder per OS, with session tokens in the system keychain instead of on disk.
Last updated
The op CLI stores account and device config in a small op folder: ~/.config/op on Unix systems and a 1Password config tree on Windows. Override it with OP_CONFIG_DIR or the config flag when scripting across machines.
Secrets themselves never sit in that folder. Sessions live in the OS keychain, and vault items stay server-side until fetched. That is why the config is safe to version-control minus device-specific lines, while tokens need keychain or env handling.
Where 1Password CLI stores this, by platform
~/.config/op
Holds config with account and device entries. Override with OP_CONFIG_DIR. Session data and caches sit in data and cache subfolders; exclude those from dotfile repos.
~/.config/op
Same role and override rules as Linux. Honors XDG_CONFIG_HOME when set; falls back to ~/.op legacy paths in documented precedence order.
%LOCALAPPDATA%\1Password\config\op
Same config file inside. Session tokens stay in Windows Credential Manager rather than this folder, matching the Unix keychain behavior.
Frequently asked questions
How do I migrate 1Password CLI to a new computer?
Copy the op config folder to the same location on the new machine, then sign in again. Device keys may need re-registration, so expect one fresh authentication.
Where are 1Password CLI session tokens stored?
They are not on disk: op holds session tokens in the OS keychain and delegates unlocks to the 1Password app. Service-account tokens live in OP_SERVICE_ACCOUNT_TOKEN env vars you manage.
Notice an outdated path? Let us know.