> ## Documentation Index
> Fetch the complete documentation index at: https://www.1password.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Allow your team to use 1Password to broker access to secrets in their workflows (public preview)

> Learn how to set up a supported integration in 1Password Business, so your team can use 1Password to broker access to secrets in their machine workflows.

export const YouTubeVideo = ({src, title, alt}) => {
  return <Frame>
      <iframe className="w-full aspect-video rounded-xl" src={src} title={alt ?? title} allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowFullScreen></iframe>
    </Frame>;
};

export const StatusBadge = ({children}) => <span className="op-status-badge not-prose">{children}</span>;

export const HighlightCard = ({title, preheader, link, src, darkSrc, children, useButton = true}) => {
  return <div className="op-card-surface bg-white dark:bg-[var(--op-surface-card-dark)] rounded-xl shadow-sm flex flex-col h-full not-prose overflow-hidden mb-4">
      {preheader && <div className="bg-gray-50 dark:bg-white/5 border-b border-[var(--op-border-card-light)] dark:border-[var(--op-border-card-dark)] px-6 py-3">
          <span className="text-sm font-medium text-gray-600 dark:text-gray-400 block">{preheader}</span>
        </div>}
      <div className="p-6 flex flex-col flex-grow">
        <h3 className="text-lg font-bold text-gray-900 dark:text-white mb-2 mt-0 flex items-center gap-2">
          {src && <>
              {darkSrc ? <>
                  <span className="dark:hidden">
                    <Icon icon={src} size={32} />
                  </span>
                  <span className="hidden dark:inline">
                    <Icon icon={darkSrc} size={32} />
                  </span>
                </> : <Icon icon={src} size={32} />}
            </>}
          {title}
        </h3>
        <div className="text-gray-600 dark:text-gray-300 mb-6 flex-grow leading-relaxed">{children}</div>
        {link && <div className="mt-auto">
            {useButton ? <a href={link.to} className="inline-flex items-center justify-center bg-[var(--op-secure-blue)] hover:bg-[var(--op-secure-blue-hover)] text-[var(--op-white)] font-medium py-2 px-4 rounded-lg transition-colors no-underline text-sm">
                {link.text || "Learn more"}
              </a> : <a href={link.to} className="highlight-card-link font-medium hover:underline inline-flex items-center gap-1 group text-sm">
                {link.text || "Learn more"}
                <Icon icon="arrow-right" className="text-inherit" />
              </a>}
          </div>}
      </div>
    </div>;
};

<StatusBadge>Public Preview</StatusBadge>

With [1Password Credential Broker](https://1password.com/blog/introducing-1password-credential-broker), administrators can set up a supported integration in their 1Password Business account to allow team members to use secrets from their [1Password Environments](/environments) in machine workflows.

<YouTubeVideo src="https://www.youtube.com/embed/5oqMWOb5tEQ" title="Using 1Password Credential Broker with GitHub Actions" />

First, an administrator sets up an integration, which defines a trust policy to control how and where the integration can be used. Team members can then connect Environments to their workflows using the configured integrations.

When a team member runs a workflow, 1Password validates the identity of the workload using an [OIDC token. <Icon icon="arrow-up-right-from-square" />](https://openid.net/developers/how-connect-works/). Secrets are only accessible after a workload has been verified, and only remain accessible for the duration of the workflow. Every request for access is recorded in your [audit log](https://support.1password.com/activity-log/).

## Add an integration

Before team members can connect their Environments to machine workflows, an administrator must set up an integration in 1Password Business.

To set up an integration:

1. As an administrator, [sign in](https://start.1password.com/signin) on 1Password.com, then select [**Developer**](https://start.1password.com/developer-tools) in the sidebar.
2. Select the [**Agents & workflows** tab](https://start.1password.com/developer-tools/active/agents-workloads), then select **Set up integrations**.
   <Tip>
     If you've already set up an integration and want to add another, select **Manage integrations** > **Add Integration**.
   </Tip>
3. Choose one of the available integrations, then follow the steps for your integration below.

<Tabs groupId="integrations">
  <Tab title="GitHub Actions">
    Before you connect your 1Password Business account to your GitHub organization, review the following requirements:

    * Your [GitHub organization <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/organizations/collaborating-with-groups-in-organizations/about-organizations) must be hosted on GitHub.com. GitHub organizations hosted on [GitHub Enterprise Server <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/enterprise-server@latest/admin/overview/about-github-enterprise-server) or [GitHub Enterprise Cloud with data residency <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/enterprise-cloud@latest/admin/data-residency/about-github-enterprise-cloud-with-data-residency) aren't currently supported.
    * If you use [GitHub Free for organizations <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/get-started/learning-about-github/githubs-plans#github-free-for-organizations), your team won't be able to use this integration for workflows in private repositories.

    If your GitHub organization meets the requirements, follow these steps:

    1. Enter a name for the integration and the name of the GitHub organization you want to connect, then select **Create integration**.
    2. The token value is your integration key, which is required to decrypt secrets in your team's workflows. Save this key in 1Password for future reference, then follow the steps to [add a new secret for your GitHub organization. <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/en/codespaces/managing-codespaces-for-your-organization/managing-development-environment-secrets-for-your-repository-or-organization#adding-secrets-for-an-organization). Set the secret name to `OP_INTEGRATION_KEY` and the value to your integration key.
  </Tab>

  <Tab title="Custom OIDC provider">
    <Note>
      Support for custom OIDC providers is gradually rolling out to 1Password Business customers. It may take a few days for you to see this integration option in your account.
    </Note>

    1. Enter a name for the integration, then enter your OIDC provider's issuer URL.
    2. Select **Verify**. If your JWKS endpoint isn't detected automatically, enter the URL manually, then select **Continue**.
    3. Define the identity requirements (claims) that must be met to verify a workload. All configured claims must match to verify the workload's identity. For example, you can use them to restrict secrets to [GitLab CI/CD jobs running in a specific project, branch, environment, etc. <Icon icon="arrow-up-right-from-square" />](https://docs.gitlab.com/ci/secrets/id_token_authentication/#token-payload)
    4. Make note of the expected audience value. Your team members will need to declare this when their workflows request an OIDC token.
    5. The token value is your integration key, which is required to decrypt secrets in your team's workflows. Save this key in 1Password for future reference, then configure the key as a secret that can be retrieved at runtime. For example, you can configure it as a [CI/CD variable in a GitLab group <Icon icon="arrow-up-right-from-square" />](https://docs.gitlab.com/ci/variables/#for-a-group), so the team members in that group can retrieve it with its variable name.
  </Tab>
</Tabs>

After you've set up an integration, your team can start connecting their 1Password Environments to their workflows:

<Columns cols={2}>
  <HighlightCard
    title="GitHub Actions"
    link={{
to: "/brokered-access/github-actions/",
text: "Learn more",
}}
    preheader=""
    useButton={false}
  >
    <p>Learn how to configure GitHub Actions workflows to retrieve secrets from 1Password Environments at runtime.</p>
  </HighlightCard>

  <HighlightCard
    title="Custom workflow"
    link={{
to: "/brokered-access/custom-workflow/",
text: "Learn more",
}}
    preheader=""
    useButton={false}
  >
    <p>Learn how to configure custom workflows to retrieve secrets from 1Password Environments at runtime.</p>
  </HighlightCard>
</Columns>

## Delete an integration

If you want to delete an integration so your team members can no longer use it to broker access to their secrets, follow these steps:

1. As an administrator, [sign in](https://start.1password.com/signin) on 1Password.com, then select [**Developer**](https://start.1password.com/developer-tools) in the sidebar.
2. Select the [**Agents & workflows** tab](https://start.1password.com/developer-tools/active/agents-workloads), then select **Manage integrations**.
3. Select **View All Integrations** under the type of integration you want to delete.
4. Select the vertical ellipsis <Icon icon="ellipsis-v" /> for the integration you want to delete, then select **Delete integration**.

After you delete an integration, any of your team member's workflows associated with the integration will no longer run successfully.

## Learn more

* 1Password Blog: [1Password Credential Broker is now in public preview](https://1password.com/blog/1password-credential-broker-public-preview)
* [1Password Environments](/environments)


## Related topics

- [Use 1Password to broker access to secrets in GitHub Actions at runtime (public preview)](/brokered-access/github-actions.md)
- [Use 1Password to broker access to secrets in custom workflows at runtime (public alpha)](/brokered-access/custom-workflow.md)
- [Get started with the 1Password Users API for Partners (Public Preview)](/users-api/get-started.md)