Platform
1Password (the source)
Every service reads its expected values from a 1Password item. Its credentials are in the base floor that every child receives.
The source is not a target: env-sync reads it to know what each target should hold, then compares fingerprints or presence.
The 1Password service account token is the widest credential in the collector and is not scoped per platform. It can read plaintext values, which is why the collector belongs in a dedicated CI environment with branch protection and code-owner review, never on a shared self-hosted runner.
More platforms
All platforms →- 01
CapRover
Collected. Compares a CapRover app’s environment with its 1Password source, pinned to one captain domain and app name.
- 02
Vercel
Collected. Compares a Vercel project’s environment variables, with one project-scoped token per service.
- 03
Render
Known to env-sync, but has no platform rule here, so pre-flight drops any service with a Render target.