Skip to content
Call wiki

How do you hand API keys to teammates' agents without anyone pasting them into a chat?

Last updated 2026-08-25 · Confidence: documented — 1Password’s developer docs and blog, Claude Code’s MCP and data-usage docs, Anthropic’s help center and Console docs; the Environments-MCP-server-in-Claude-Code claim is inferred.

Store each key in a shared 1Password vault, put an op:// reference (never the value) in the config, and launch the agent under op run so the key exists only in the process’s environment. Attribution comes from issuing one key per person, not from 1Password.

Secret references and op run: the standard path

Section titled “Secret references and op run: the standard path”

1Password CLI addresses a field as op://<vault>/<item>/<field>. Put ANTHROPIC_API_KEY=op://Team/Claude/credential in a .env and run op run --env-file .env -- <command>: op run resolves the references into the subprocess’s environment, drops them on exit, and masks them in output. Files holding only references are safe to commit. Unlock is Touch ID or Windows Hello once the desktop app’s “Integrate with 1Password CLI” setting is on.

Sharing is vault access: teammates run the same command and nobody pastes anything. 1Password Environments add a project-shaped layer — import a .env, share it, mount it locally “without writing your credentials to disk” — once an Owner or Admin enables the policy.

Wiring it into Claude Code

Section titled “Wiring it into Claude Code”

.mcp.json expands ${VAR} in command, args, env, url, and headers, so "Authorization": "Bearer ${API_KEY}" plus op run -- claude keeps the key out of the file and the transcript — the pattern in 1Password’s MCP-security post. A headersHelper running op read does it per server. Native op:// values in settings.json are requested, not shipped.

1Password’s agent products solve adjacent problems:

  • Agentic Autofill and the Claude integration fill website logins into an agent’s browser after biometric approval — logins, not API keys. - The Environments MCP server lets an agent create and list variables but “cannot return secret values … to the client”; docs list Codex, Cursor, and Kiro, though any stdio client should work.

Why pasting is worse than it looks, and who did what

Section titled “Why pasting is worse than it looks, and who did what”

Claude Code keeps transcripts in plaintext under ~/.claude/projects/ for 30 days and Anthropic retains commercial data 30 days; a pasted key lives in both. Anthropic’s help center: “never share your API key”, separate keys per environment.

A vault-shared key is still one key. The usage report filters by api_key_ids[], so a key per person and per automation is what makes a spike traceable. Keys are scoped to a workspace, which can carry a spend cap; only the auto-created Claude Code workspace binds keys to users. See Agent safeguards for the rest of the blast-radius controls.

Sources

Section titled “Sources”