This combination of tooling is just awesome for getting tooling, environment variables, and secrets setup and available for Claude Code to do work.
mise for tooling & environment is slick and just works. Being able to pull tools from various backends saves so much time.
fnox makes accessing secrets really easy. And if you leverage the 1Password provider then you can take advantage of vaults for security. Combine that with a service account in 1Password then you have a really slick flow.
My new project setup is to have an fnox.toml that looks like this:
[providers.age]
type = "age"
recipients = ["age-public-key"]
[providers.op]
type = "1password"
vault = "Project - My awesome project"
token = { secret = "OP_SERVICE_ACCOUNT_TOKEN" }
[secrets]
# `env = false` prevents it being exposed in the shell environment
OP_SERVICE_ACCOUNT_TOKEN = { provider = "age", value = "age-encrypted-value", env = false }
SOME_SECRET = { provider = "op", value = "Entry/credentials" }I typically create a 1Password service account and store the secret in 1Password in a vault I control. Then store it, encrypted with age using the fnox support like this:
op read "op://1Password Service Accounts/Project - My awesome project/credential" | fnox set OP_SERVICE_ACCOUNT_TOKEN --provider age