The parts
What the person sees
1
Setup
The person turns on the 1Password connection in your app. A one-time web flow opens: they sign in at 1password.com and approve a consent screen that lists what your integration can and can’t do. After that you can send them access requests, but you can’t read any of their items.
2
The agent asks for logins
The person asks your agent to do something that needs a sign-in. Your agent creates an access request, and your app shows an approval button. When the person taps it, their device switches to the 1Password app. If 1Password is locked, they unlock it with Face ID, Touch ID, or their account password.1Password shows which integration is asking, the goal of the task, and suggested logins for each website. The person picks the logins to share, approves, and lands back in your app.
3
The agent finishes the task
Your agent fills the approved logins for the rest of the task. It works in the background and needs nothing more from the person. 1Password doesn’t need to be running or unlocked on their device.
A task from request to fill
Your agent makes these calls through the extension. If your product needs to make them outside the browser, such as before a browser exists, contact 1Password to review the security requirements. See Use the SDK.Why approval happens in the 1Password app
Every item in a 1Password account is end-to-end encrypted, and 1Password’s servers can’t decrypt a stored item on their own. Approving a login is cryptographic work: the person’s 1Password app uses keys only it holds to make that one login usable by your integration and no one else. That has two consequences:- Nothing you hold can create a grant. Your tokens and integration key let you ask for logins and use the ones the person approved. They can’t add a login the person didn’t approve.
- The person needs a 1Password app on their device, signed in to the account they connected, to respond to your requests.
What approval covers
Approval covers the logins the person selected for use by your integration. It isn’t tied to a chat session, and one approval can authorize multiple fills, including multi-page sign-ins.- If your product promises approval per session, enforce it yourself: create a new access request for each session, and don’t reuse references from an earlier one.
- At launch, a grant lasts 30 days. It ends sooner if you disconnect the person or their connection expires. When a fill fails because access ended, create a new access request.
What each party holds
See Store keys and tokens for handling rules, and Security model for the protections 1Password provides and the responsibilities your integration retains.