LastPass Provider

LastPass password manager integration

The LastPass provider integrates with LastPass password manager for secure cloud-based secret storage.

At a glance

Quick start

# Set a secret
$ secretspec set DATABASE_URL --provider lastpass
Enter value for DATABASE_URL: postgresql://localhost/mydb


# Get a secret
$ secretspec get DATABASE_URL --provider lastpass


# Run with secrets
$ secretspec run --provider lastpass -- npm start

Setup

Prerequisites

Install LastPass CLI:

# macOS
$ brew install lastpass-cli


# Linux (apt)
$ sudo apt install lastpass-cli


# NixOS
$ nix-env -iA nixpkgs.lastpass-cli

Authentication

# Standard login
$ lpass login [email protected]


# Trust device (reduces MFA prompts)
$ lpass login --trust [email protected]

Configuration

URI format

lastpass://[item_template]

item_template is optional and replaces the default secretspec/{project}/{profile}/{key} layout. It supports the {project}, {profile}, and {key} placeholders. Include {key} unless every SecretSpec key should resolve to the same LastPass item.

URI examples

# Default SecretSpec layout
lastpass


# Keep SecretSpec items in a team folder
lastpass://Work/SecretSpec/{project}/{profile}/{key}

Project configuration

secretspec.toml

[providers]
team = "lastpass://"


[profiles.production]
DATABASE_URL = { description = "Database URL", providers = ["team"] }

Storage model

Changed in version 0.21: Values containing NUL bytes are rejected before writing because the LastPass CLI would silently truncate them. Declare encoding = "base64" to store these values without data loss.

By default, each secret maps to an item named secretspec/{project}/{profile}/{key}. A custom item_template replaces that layout; include all placeholders needed to keep secrets distinct.

Use existing secrets

A secret’s ref field names an existing item instead: item is the full item name, including any folder (field is not supported). Reads and writes target that item in place.

[profiles.production]
DATABASE_URL = { description = "DB", ref = { item = "Shared-Infra/Production DB" }, providers = ["lastpass"] }

CI/CD

# Disable interactive pinentry and authenticate with a CI-managed password
$ export LPASS_DISABLE_PINENTRY=1


$ echo "$LASTPASS_PASSWORD" | lpass login --trust [email protected]


$ secretspec run --provider lastpass -- deploy

Last updated Oct 11, 2026