Environment variables from 1Password
Connect your team's 1Password service account on Settings → Integrations, and any environment variable's value can be a secret reference, op://vault/item/field, instead of the secret. The app's code reads the secret as process.env.NAME; it's read from 1Password at every build, so the secret stays in your vault.
Each environment has its own reference, so production can read from a vault development never sees. A dev server waking uses what the last build read, and Sync now in the integration's drawer reads every reference again after you rotate a secret: development restarts with it and production gets it on its next deploy.
A reference that doesn't resolve fails the build with the variable's name and why, such as a missing item or a vault the service account can't read, instead of starting the app without its secret.
More in Secrets from 1Password.