I tried out the ability to manage .env files with 1Password Environments
This page has been translated by machine translation. View original
In iOS development, managing secret information such as API keys and Firebase configuration is an important challenge. Many developers manage environment variables using .env files, but since they are stored in plain text on disk, there is always the risk of accidentally committing them to Git.
I use Arkana to obfuscate secret information (for more details about Arkana, see my previous article), but managing the underlying .env files had been a challenge.
In October 2025, a new 1Password feature called "1Password Environments" was released as a public beta. This feature allows you to virtually mount .env files and manage secret information without writing it to disk.
This article introduces how to use 1Password Environments in combination with Arkana and Xcode Cloud.
Verification Environment
- macOS 15.7.1 (24G231)
- Xcode 26.1.1
- 1Password Desktop App 8.11.18
- Arkana 1.4.0
Challenges with Traditional .env File Management
The following are the challenges with .env files that many developers face.
Security Risks
- Secret information is stored in plain text on disk
- Risk of accidentally committing to Git by forgetting to add
.gitignore - May be included in macOS backups
Challenges in Team Development
- Sharing secrets with new members is cumbersome
- Sending API keys via Slack or email is not desirable from a security standpoint
- Reflecting environment variable updates across the entire team is troublesome
Development Machine Migration
- When setting up a new Mac, you need to search for secrets from past chats and documents
What is 1Password Environments
1Password Environments is a feature that provides a dedicated workspace for securely managing secret information in development projects.
Key Features
- Virtually mounts a
.envfile at a specified path - Secret information is not written to disk
- Data is passed directly to applications through UNIX pipes
- Fully compatible with existing dotenv libraries
- Tools that read
.envfiles such as Arkana work as-is
How Virtual Mounting Works
By having 1Password virtually mount a .env file, the physical file does not exist, but applications can read it as a normal file. Access is automatically blocked when 1Password is locked, and cached values remain accessible even offline.
Development Environment Configuration
I develop iOS apps personally outside of work, and I manage secrets using the following configuration.
Local Development Environment
1Password Environments (.env virtual mount)
↓
Arkana (obfuscated code generation)
↓
Xcode (build)
CI/CD Environment (Xcode Cloud)
Xcode Cloud environment variables
↓
Arkana (obfuscated code generation)
↓
Build & Distribution
This configuration enables consistent and secure secret management both locally and in CI/CD.
1. Enabling 1Password Developer Features
First, enable developer features in 1Password.
- Launch the 1Password desktop app
- Open Settings > Developer
- Turn on [Show 1Password Developer Experience]
This will display the "Developer" section in the sidebar.
2. Creating an Environment
Open the Developer section in the sidebar. Click the [Show Environments] button on the Environments tile.
Click the [New Environment] button. An input dialog for the environment name will appear. Enter an appropriate environment name and click the Save button. For this example, the name of the app under development was used as the environment name.
Click the [Show Environment] button for the created app (environment).
3. Importing the .env File
Click the [Import .env file] button.
Select the .env file to import.
Review the imported keys and values, then click the [Save] button.
Once the import is complete, each environment variable is encrypted as a 1Password item and stored securely.
4. Deleting the Original .env File
For security purposes, delete the original .env file.
cd /Users/ch3cooh/works/NSEasyConnect/NSEasyConnect
# Backup just in case
cp .env .env.backup
# Delete
rm .env
# Verify that .env is included in .gitignore
cat .gitignore | grep .env
5. Configuring the Local .env File Mount
Next, mount the virtual .env file.
Open the Destinations tab. Click the [Set Destination] button on the Local .env File tile.
Click the [Select File Path] button.
Specify the path where the .env file was previously located.
After specifying the path for the .env file, click the [Mount .env File] button.
The .env file is now virtually mounted at the specified path.
6. Verifying Access to .env
Verify that the .env file is accessible.
vim /Users/ch3cooh/works/NSEasyConnect/NSEasyConnect/.env
When accessing the same file path, 1Password hooks in and an access request dialog appears. After authenticating, the .env file becomes accessible.
After authentication, the .env file becomes accessible as before.
# This file was generated by 1Password. Manual edits will be lost.
# For more information, see: https://developer.1password.com/docs/environments/local-env-file
revenueCatApiKey=XXXXXX_XXXXXXXXXXXXXX
7. Verifying Arkana Operation
Run Arkana to verify that obfuscated code is generated correctly.
# Run in the project directory
bundle exec arkana
Upon success, obfuscated code such as ArkanaKeys is generated as usual. This confirms that the .env file mounted by 1Password is being read correctly.
For detailed instructions on configuring Arkana, please refer to my previous article.
8. Integration with Xcode Cloud
In CI/CD environments using Xcode Cloud, the environment variable feature of Xcode Cloud is used instead of 1Password Environments.
8-1. Setting Environment Variables in Xcode Cloud
- Open App Store Connect
- Select the target app
- Open Xcode Cloud > Settings
- Add environment variables in the Environment Variables section
Example:
revenueCatApiKey = appl_xxx...
Check the Secret checkbox for each variable to protect the value.
8-2. Arkana Reading Environment Variables
By default, Arkana reads values in the following priority order:
- Environment variables
.envfile
That is, without any special configuration:
- Local: Reads from the
.envfile mounted by 1Password - Xcode Cloud: Reads from environment variables
Operational Notes
1Password App Must Be Running
When running Arkana, the 1Password desktop app must be:
- Running
- Unlocked
If it is locked, the build will fail.
CI/CD Environments Require Separate Configuration
In CI/CD environments (Xcode Cloud, GitHub Actions, etc.), 1Password Environments cannot be used. You need to use the confidential information management features of each environment.
However, since 1Password also provides integration with AWS Secrets Manager, this can be considered for use in full-scale CI/CD environments. This article does not cover verification of AWS Secrets Manager usage.
Windows is Currently Not Supported
Currently, 1Password Environments only supports Mac and Linux. The Windows version is reportedly under development.
Benefits
Here is a summary of the benefits I felt after actually operating this setup.
Improved Security
- Since the
.envfile does not physically exist on disk, it is impossible to accidentally commit it to Git - Even running
git add .will not detect the virtual file - Locking 1Password automatically blocks access to the
.envfile
Improved Development Efficiency
- When setting up a new Mac, environment variables are restored simply by logging into 1Password
- Clone the project, mount the Environment, and development can begin immediately
- Cached values are accessible even offline
Benefits for Team Development
- Use 1Password's sharing feature to securely share environment variables with team members
- No longer need to send secrets via Slack
- Change history of environment variables is recorded in 1Password
Summary
After actually operating 1Password Environments, I find it more convenient than expected. In particular, since the .env file does not physically exist, I have been completely freed from the anxiety of "what if I accidentally commit it to Git."
In the context of iOS app development, combining it with Arkana allowed me to improve security while maintaining existing workflows. By managing .env files with 1Password Environments for local development and using the environment variable features of Bitrise or Xcode Cloud for CI/CD environments, consistent secret management can be achieved.
It is currently available as a public beta supporting macOS/Linux, with the Windows version reportedly under development. Although still in beta, it operates stably, and I think it is worth trying for anyone who feels challenged by secret management in iOS development.
Reference Links
- 1Password Environments Official Blog
- 1Password Environments Documentation
- Arkana - GitHub
- Migrating from cocoapods-keys to Arkana + SPM in preparation for the end of CocoaPods - Previous article by the author
- 1Password Developer Settings
Job Openings: Classmethod is Hiring iOS Engineers
The Starbucks Digital Technology Division is looking for engineers capable of iOS app development. We are waiting for applications from people who want to work with us while sharing various things about new Xcode and iOS features in misc-ios and similar channels!
We are also hiring iOS/Android engineers in other areas. Let's talk about mobile app development together!