I use 1Password's `op` for this, but with an allowance: my dev environment keys.

I found I was getting fingerprint fatigue. Do I need a fingerprint request every time my dev server wants to connect to dev Supabase? No. That's expected, and zero risk. There's no data there.

I worried that a nefarious request would be auto-approved by me. When you see 20 requests a day, your muscle memory just reaches for the sensor.

So I have a separate 1Password vault that a service account [0] can read. That token is in my environment as OP_SERVICE_ACCOUNT_TOKEN, which the `op` tool understands.

It also has access to a vault with 'AI-safe' keys that I want Claude to be able to access without asking me.

Now, these requests work invisibly. And when I see a fingerprint popup, it's unusual, and I don't auto-approve by habit.

I also keep an item called '_One-day keys' in a separate vault. (The underscore just pushing it to the top of the list for easy access.)

It has prod keys, mostly restricted read-only. If required, I move that over to the open vault. Claude knows this item and has instructions to remind me to move it back out when it's finished what it was doing.

[0]: https://www.1password.dev/service-accounts/get-started