How to keep your .bashrc / .zshrc free of secrets!

.zshrc

############## 1Password Stuff ###############

# Check for 1Password CLI, and install if necessary:
command -v op >&- || brew install --cask 1password-cli

# You can simply export the 1Password secret's deep link in
# place of any sensitive value held in an environment variable:
export JIRA_API_TOKEN="op://example_vault/JIRA_API_TOKEN/credential"

# To use this at runtime, use:  `op run -- <app> ..args..`
# Or, my preferred approach: make helper/wrapper functions:

jira() {
  JIRA_API_TOKEN="op://example_vault/JIRA_API_TOKEN/credential" \
    op run -- jira "$@"
}

# You can even use it for AWS MFA - every single day! (Hey! That rhymes...)

aws-mfa() {
  /usr/local/bin/aws-mfa <<< $(op item get "aws-example" --otp)
}