DOCSEARCHbyAlgolia
Submit Docs

1Password Developer Documentation

website·Indexed 33 days ago

https://www.1password.dev/

Developer resources for 1Password, featuring the SaaS Manager API for managing applications, contracts, devices, and people. Includes SCIM 2.0 protocol implementation for user management, agent hooks, agentic autofill for AI agents, and AI-readable documentation via llms.txt and MCP.

Tokens
197.4K
Snippets
992
Records
1.6K
Agent score
70%

What's inside 1Password

  1. Overview of 1Password Agentic Autofill

    1Password Agentic Autofill allows AI agents to sign in to websites on a user's behalf without the user providing plaintext secrets or environment variables to the agent. When an agent needs to sign in, the user is prompted via the 1Password desktop app to approve or deny the request. Upon approval, the 1Password browser extension in the agent's headless browser autofills the credentials over an end-to-end encrypted channel.

  2. Overview of 1Password Credential Broker

    The 1Password Credential Broker allows administrators of 1Password Business accounts to define trust policies via integrations. This enables team members to access secrets from 1Password Environments in machine workflows. 1Password validates the identity of the workload using an OIDC token; secrets are only accessible after verification and only for the duration of the workflow. All access requests are recorded in the audit log.

  3. Overview of 1Password developer tools and capabilities

    1Password provides a suite of tools designed to secure development workflows by removing plaintext secrets from code and configuration, simplifying SSH/Git management, and providing programmatic access to secrets. Key capabilities include biometric authentication for CLI tools, secure secret injection for local and production environments, and SDKs for application integration.

  4. Overview of 1Password Users API for Partners

    The 1Password Users API for Partners is a REST-style API based on OAuth 2.0 designed for 1Password Business tier (Enterprise Password Manager) accounts. It enables the creation of security automation integrations to automate account access controls, trigger access remediation (such as suspending or reactivating users) based on SIEM-detected events, and reduce manual processes during security incidents.

  5. Overview of 1Password Service Accounts

    1Password Service Accounts provide a non-individual authentication method for the 1Password CLI, enabling the automation of secrets management in applications and infrastructure without deploying additional services. They allow administrators to control access to specific vaults and Environments and define permitted actions. Service accounts help implement the principle of least privilege by avoiding the SSO and MFA requirements associated with personal user accounts. A single account can have up to 100 service accounts.

  6. Overview of 1Password Shell Plugins

    1Password Shell Plugins allow you to authenticate third-party CLI tools using your 1Password account. This eliminates the need to manually enter credentials or store them in plaintext on your machine. Authentication can be performed via fingerprint, Apple Watch, or other system authentication methods. The plugins are compatible with Bash, Zsh, and fish shells.

  7. Overview of 1Password Secrets plugin for Jenkins

    The 1Password Secrets plugin for Jenkins allows you to securely load secrets from 1Password as environment variables in a Jenkins CI/CD pipeline using secret references. This eliminates the need to store plaintext secrets in code. The plugin can be authenticated using either a 1Password Service Account or a 1Password Connect Server (if both are configured, the Connect server takes precedence).

  8. Overview of 1Password local .env file validation hook

    The 1Password local .env file validation hook ensures that locally mounted .env files from 1Password Environments are properly set up before an AI agent executes shell commands. If required files are missing or invalid, the hook blocks execution and provides instructions for resolution.

    Supported Agents: Claude Code, Cursor, GitHub Copilot, and Windsurf.

    Requirements:

    • 1Password subscription
    • 1Password for Mac or Linux (Windows is not supported; the hook will skip validation on Windows)
    • sqlite3 installed and available in the system PATH

  9. Overview of 1Password Environments MCP Server

    The 1Password Environments MCP Server allows MCP clients (like Claude Code, Cursor, and Codex) to securely manage 1Password Environments. It enables agents to create, list, and rename Environments, list variable names, add variables, and create locally mounted .env files. For security, the server only exposes variable and Environment names; it never returns the actual secret values to the agent. The server runs locally as part of the 1Password desktop app and requires user approval via secure prompts for per-Environment access.

  10. Overview of 1Password Environments

    1Password Environments allow developers to organize and manage project environment variables separately from standard vault items. They enable secure access to secrets via locally mounted .env files (without writing plaintext to disk), programmatic access via CLI/SDKs (Go, JavaScript, Python), synchronization with AWS Secrets Manager, and integration with IDEs/agents (like Cursor and GitHub Copilot) via agent hooks.

  11. Overview of 1Password Service Accounts

    1Password Service Accounts allow for the automation of secrets management in applications and infrastructure. They use a service account token for authentication, typically provided as an environment variable.

    Capabilities:

    • Create, fetch, edit, delete, and share items.
    • Read environment variables from 1Password Environments.
    • Create vaults (and delete vaults that the service account itself created).
    • Retrieve information about users and groups.

    Key Constraints:

    • Permissions, vault access, and Environment access are immutable after creation. To change them, you must create a new service account.
    • Service accounts only have read access to Environments.
    • They cannot be granted access to built-in Personal, Private, Employee, or default Shared vaults.
    • Requires 1Password CLI version 2.18.0 or later.
    • Compatible with the Kubernetes Secrets Injector, but NOT the Kubernetes Operator.

  12. Overview of 1Password Kubernetes Secrets Injector

    The 1Password Kubernetes Secrets Injector is a mutating webhook that allows you to inject 1Password secrets into your resources using a 1Password Service Account or a Connect server for authentication. Unlike the Kubernetes Operator, the Secrets Injector does not create a Kubernetes Secret when assigning secrets to a resource.