> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/guides/understand/coming-from-another-tool.md).

# Coming from another secrets tool

Map the 1Password CLI, Bitwarden CLI, and Infisical CLI commands you already use to their Devolutions CLI equivalents, and what works differently.

If you already use 1Password CLI, Bitwarden CLI, or Infisical CLI, most of your habits carry over. Devolutions CLI follows the same idea: your files and scripts hold a reference, and the value is fetched only when a command needs it. The references start with `devo://`, and the secrets come from your workspace: Devolutions Cloud, Devolutions Server, or a local Devolutions Remote Desktop Manager profile.

Before you start, sign in once with `devo login`. Every command below then uses the current context, or the one you pass with `--context <context-name>`. Canonical references are the exception: they always resolve against the workspace that owns them, whatever context is selected. See [How Devolutions CLI works](/cli/guides/understand/how-it-works.md).

## Command equivalents

<table><thead><tr><th width="220">IF YOU USE</th><th width="250">IN DEVOLUTIONS CLI</th><th>DIFFERENCE</th></tr></thead><tbody><tr><td><strong>1Password CLI</strong> <code>op read op://&#x3C;vault>/&#x3C;item>/&#x3C;field></code>, to print the value of one field.</td><td><code>devo secret read devo://&#x3C;workspace>/&#x3C;vault>/&#x3C;entry>/&#x3C;field></code></td><td>A named reference also includes the workspace. You can use a canonical reference instead, built from IDs (<code>devo://ws/&#x3C;workspace-id>/vault/&#x3C;vault-id>/entry/&#x3C;entry-id>/field/&#x3C;field></code>), which keeps working after a rename. See <a href="/cli/reference/secret-references.md">Secret reference syntax</a>.</td></tr><tr><td><strong>1Password CLI</strong> <code>op run -- &#x3C;command></code>, to start a command with secrets in its environment.</td><td><code>devo secret run --env-ref &#x3C;NAME>=&#x3C;reference> -- &#x3C;command></code></td><td>Output is masked by default too: resolved values show as <code>&#x3C;concealed by Devolutions></code>, and <code>--no-masking</code> turns it off. Devolutions CLI refuses a command argument that is a reference: pass references with <code>--env-ref</code>, <code>--stdin-reference</code>, an environment file, or a launch manifest. See <a href="/cli/guides/secrets/run-with-secrets.md">Run a command with its secrets</a>.</td></tr><tr><td><strong>1Password CLI</strong> <code>op run --env-file &#x3C;file></code>, to resolve the references of a <code>.env</code> file.</td><td><code>devo secret run --env-file &#x3C;file> -- &#x3C;command></code></td><td>The file holds <code>devo://</code> references instead of <code>op://</code> ones. A variable name can come from one source only: if <code>--env-ref</code> also sets it, the command stops with a conflict instead of choosing. See <a href="/cli/guides/secrets/replace-env-files.md">Take the passwords out of a .env file</a>.</td></tr><tr><td><strong>1Password CLI</strong> <code>op inject</code>, to fill a template with secret values.</td><td><code>devo secret inject --in-file &#x3C;template> --out-file &#x3C;file></code></td><td>You can wrap a reference in <code>{{ }}</code> to mark exactly where it starts and ends. An existing output file is replaced only with <code>--force</code>. See <a href="/cli/guides/secrets/fill-a-template.md">Fill a configuration file from a template</a>.</td></tr><tr><td><strong>Bitwarden CLI</strong> <code>bw get password &#x3C;item></code>, to print the password of one item.</td><td><code>devo secret get password "&#x3C;entry-name>"</code>, or <code>devo secret read &#x3C;reference></code></td><td><code>devo secret get</code> takes the field and the entry name (or <code>id:&#x3C;entry-id></code>), and uses the current vault unless you add <code>--vault</code>. It reads other fields the same way, such as <code>username</code> or <code>host</code>. There's no session key to pass: Devolutions CLI uses the context you saved with <code>devo login</code>.</td></tr><tr><td><strong>Infisical CLI</strong> <code>infisical run -- &#x3C;command></code>, to start a command with the secrets of a project in its environment.</td><td><code>devo secret run -- &#x3C;command></code></td><td>Devolutions CLI passes only the secrets you name: each <code>--env-ref</code>, each reference in an environment file, and each variable of your shell whose value is a <code>devo://</code> reference. See <a href="/cli/guides/secrets/run-with-secrets.md">Run a command with its secrets</a>.</td></tr><tr><td><strong>SecretSpec</strong> with another provider, such as 1Password or Bitwarden.</td><td><code>devo secretspec register</code>, then the provider URI from <code>devo secretspec uri</code></td><td>Each secret in <code>secretspec.toml</code> names the entry ID and the field, and optionally a vault. Convention-based addresses (project, profile, and key) are refused. See <a href="/cli/guides/secrets/secretspec.md">Use Devolutions CLI with SecretSpec</a>.</td></tr></tbody></table>

{% hint style="warning" %}
Like `op read`, `op inject`, and `bw get`, the commands `devo secret read`, `devo secret get`, and `devo secret inject` hand you the actual value. Prefer `devo secret run` whenever your program can read its secrets from the environment. See [What stays hidden, and what doesn't](/cli/guides/understand/security-model.md).
{% endhint %}

## Move your references

1. Find the reference of each secret with `devo entry references "<entry-name>" --vault-name "<vault-name>"`. It lists references without reading any value. See [Find the reference to a secret](/cli/guides/secrets/find-a-reference.md).
2. Replace each `op://` reference, or each value your scripts read from another tool, with the `devo://` reference.
3. Replace the command that started your program, for example `op run` or `infisical run`, with `devo secret run`.
4. Before the first real run, add `--check` to make sure the program exists and every reference is well formed, without reading any value.

## Next

* [Run a command with its secrets](/cli/guides/secrets/run-with-secrets.md)
* [Sign in from a CI pipeline](/cli/for-devops-and-administrators/automate/ci-sign-in.md)
* Every option of `devo secret`: [Commands](/cli/reference/commands.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/guides/understand/coming-from-another-tool.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.