1Password Already Works with Codex: How Environments MCP Keeps API Keys Out of the Model
While researching 1Password for Claude, I learned that 1Password had already released an integration for OpenAI’s Codex. It was announced on May 20, 2026—about two months before the Claude version—under the name “1Password Environments MCP Server for Codex.”
Both integrations are designed to keep secrets away from the AI model, but they solve different problems. The Claude integration helps log into websites. The Codex integration lets an application use API keys and database credentials without writing them into code or prompts.
This is not only an enterprise security feature. If you have ever pasted an API key into Codex and asked it to test an app, it applies directly to your workflow.
The Codex integration protects secrets used during development
Codex can do more than write code. It can run the program, connect to an API, work with a database, and test the result before release. Those steps often require secrets such as API keys, access tokens, and database passwords.
A common approach is to place them in a .env file or set them as terminal environment variables. Even when .env is excluded from Git, its contents remain in plain text on the computer. If Codex can read the whole project, the secret may enter its context along with the files required for the task.
1Password Environments MCP treats Codex as an operator allowed to run a process, not as the keeper of the secret. Codex can work with variable names and environment structure without receiving the original values.
How it differs from 1Password for Claude
The two integrations use the same vault but deliver secrets to different destinations.
| Point of comparison | 1Password for Claude | 1Password and Codex |
|---|---|---|
| Main purpose | Log into a website | Run an app or development tool |
| Information handled | Usernames, passwords, and one-time codes | API keys, tokens, and database credentials |
| Where the secret goes | A browser login form | An approved running process |
| Main connection | Claude app, browser extension, and 1Password | Codex, a local MCP server, and 1Password Environments |
| Everyday example | Open a booking site or administration panel | Run an app that calls an external API |
With Claude, 1Password fills a web form directly from the vault. With Codex, 1Password injects the required variables into an application process at runtime. The raw values are not returned through MCP, added to the model context, or written to disk.
The secret is supplied only while the approved process runs
- The user asks Codex to build or test an application
- Codex asks the local 1Password MCP server to prepare the required environment operation
- The 1Password app verifies identity and permissions, and the user approves access
- Codex manages the environment and variable names and identifies the application to run
- 1Password injects the required values only into that application’s process at runtime
The values exist only in the approved process’s memory for as long as they are needed. Codex can run the application without reading the secret string itself. According to 1Password, each operation involving 1Password requires explicit user approval.
It can also clean up secrets already stored in a project
The integration is not limited to creating a safe environment from scratch. 1Password also describes using Codex to inspect a repository, find secrets left in source code or configuration files, move them to 1Password, and replace the original values with references.
- Set up a new development environment without distributing a
.envfile - Find API keys written directly into code
- Move secret values into 1Password and replace them with references
- Separate staging and production environments from the development configuration
Security cleanup no longer has to be a separate project from development. The storage location of a secret can be improved during the same Codex-assisted revision.
Three places worth checking even before you enable the integration
- Chats and instructions: Have you pasted an API key directly?
- Code and configuration files: Are keys or passwords hard-coded?
.envand Git history: Did a secret enter an earlier commit even if the file is ignored now?
If a secret ever reached a public repository or AI conversation, moving it is not enough. Revoke the original API key or token and issue a new one. Start with a development credential that has limited permissions instead of exposing a production secret.
The handoff is safer, but the action can still be harmful
1Password reduces the risk that Codex reads the API key itself. The approved application can still use the credential to reach an external service. 1Password cannot prevent flawed code from deleting data or making an excessive number of API calls.
Begin with a test environment and read-only credentials. Review the command and destination before it runs. Hiding a secret and deciding what the AI is allowed to do with it are separate security decisions.
Currently a Mac feature, with prerequisites to check
As of July 18, 2026, 1Password Marketplace listed the Codex MCP integration as macOS-only. It requires both 1Password and OpenAI services, plus access to 1Password Password Manager and its developer features.
Individual users enable the feature through 1Password Labs. Organizations using 1Password Enterprise Password Manager must have an administrator enable the 1Password Environments beta policy, after which each user opts in. The requirements and menus may change, so follow the Marketplace instructions when installing it.
Remember: Claude handles login, Codex handles the runtime environment
The Claude and Codex integrations do not compete. Claude can receive login credentials safely when operating a website, while Codex can receive runtime secrets safely when executing code.
If Codex already works with external APIs or databases in your projects, the first step is to inspect .env files and hard-coded keys. The goal is not to let AI remember the secret, but to let one approved process use it briefly. That is the principle 1Password Environments MCP brings to everyday development.
References: 1Password: 1Password is now a trusted access layer for OpenAI’s Codex, 1Password Press Release, 1Password Marketplace: 1Password Environments MCP Server for Codex, and Mado no Mori coverage (Japanese). Availability and specifications were checked on July 18, 2026. Security descriptions are based on 1Password’s official material; the author had not tested the integration in a production environment at the time of writing.
