> ## Documentation Index
> Fetch the complete documentation index at: https://www.1password.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Use 1Password to broker access to secrets in custom workflows at runtime (public alpha)

> Learn how to configure custom workflows to retrieve secrets from 1Password Environments at runtime.

export const StatusBadge = ({children}) => <span className="op-status-badge not-prose">{children}</span>;

<StatusBadge>Public Alpha</StatusBadge>

If an administrator has [connected an OIDC provider to your 1Password Business account](/brokered-access), you can use 1Password to broker access to secrets from your 1Password Environments in your custom workflows at runtime.

## Step 1: Set up an Environment

To configure the variables you need to use in a custom workflow, make sure you have the [latest beta release of the 1Password desktop app](https://support.1password.com/betas/#install-a-prerelease-version-of-the-1password-app), then create a new [1Password Environment](/environments#create-an-environment) with your variables or [add your variables](/environments#add-variables-to-an-environment) to an existing Environment.

## Step 2. Connect your Environment to your workflow

After you've set up an Environment and added your secrets, you can connect the Environment to your workflow:

1. Open your Environment, then select **Connect** in the Generic OIDC section.
   <Tip>
     If you've already connected your Environment to a workflow, select
     **Connect** instead, then select **Connect** in the Generic OIDC section.
   </Tip>
2. Enter a name for your workflow, then choose the integration for the OIDC provider you need to use.
3. (Optional) Define any additional access conditions you want to enforce. You'll also see any inherited conditions your administrator configured for the integration.
4. Select **Connect**.

## Step 3: Use your Environment in your workflow

After you've connected your Environment to a custom workflow, you'll need to create a [1Password SDK](/sdks) client configured with a custom function to fetch your OIDC token. The client authenticates using your OIDC token, workload ID, and the [integration key configured by your administrator](/brokered-access#custom-oidc-provider), then uses a function to retrieve secrets from your Environment using the Environment ID.

<Note>
  Brokered access is only supported in the the [1Password JavaScript SDK <Icon icon="arrow-up-right-from-square" />](https://github.com/1Password/onepassword-sdk-js) at this time.
</Note>

## Usage example

The following example shows how you can use a 1Password JavaScript SDK client to call a function that fetches your OIDC token, then uses it alongside the other required variables to retrieve secrets from your Environment in a [GitLab CI/CD job. <Icon icon="arrow-up-right-from-square" />](https://docs.gitlab.com/ci/jobs/)

<Tabs groupId="examples">
  <Tab title="1Password SDK client example">
    ```javascript op-client-example.js theme={null}
    const sdk = require("@1password/sdk");
    const { spawn } = require("node:child_process");

    async function fetchOidcToken() {
        return process.env.GITLAB_SUBJECT_TOKEN;
    }

    function loginToDockerCLI(username, token) {
        return new Promise((resolve, reject) => {
            const login = spawn(
                "docker",
                ["login", "--username", username, "--password-stdin"],
                { stdio: ["pipe", process.stderr, process.stderr] },
            );

            login.on("error", reject);
            login.on("close", (code) => {
                if (code === 0) {
                    resolve();
                    return;
                }
                reject(new Error(`docker login exited with status ${code}`));
            });
            login.stdin.end(token);
        });
    }

    async function loginWithEnvironmentCredentials() {
        const client = await sdk.createClient({
            integrationName: "GitLab CI",
            integrationVersion: "v1.0.0",
            oidcFetcher: fetchOidcToken,
            workloadDetails: {
                workloadUuid: process.env.OP_WORKLOAD_ID,
                // SDK 0.5.0-beta.1 only accepts unpadded integration keys.
                customerManagedSecret: process.env.OP_INTEGRATION_KEY.replace(/=+$/, ""),
            },
        });

        const { variables } = await client.environments.getVariables(
            process.env.OP_ENVIRONMENT_ID,
        );
        const dockerHubUsername = variables.find(
            ({ name }) => name === "DOCKERHUB_USERNAME",
        ).value;
        const dockerHubToken = variables.find(
            ({ name }) => name === "DOCKERHUB_TOKEN",
        ).value;

        await loginToDockerCLI(dockerHubUsername, dockerHubToken);
        process.stdout.write(dockerHubUsername);
    }

    loginWithEnvironmentCredentials().catch((error) => {
        console.error(error);
        process.exitCode = 1;
    });
    ```
  </Tab>

  <Tab title="GitLab CI/CD job example">
    ```yaml .gitlab-ci.yml theme={null}
    build-and-push:
      image: docker:27-cli
      services:
        - docker:27-dind
      id_tokens:
        GITLAB_SUBJECT_TOKEN:
          aud: $OP_OIDC_AUDIENCE
      variables:
        DOCKER_TLS_CERTDIR: "/certs"
      before_script:
        - apk add --no-cache nodejs npm
        - npm ci
      script:
        # Authenticate Docker CLI with credentials stored in 1Password environment.
        - DOCKERHUB_USERNAME="$(node ./op-client-example.js)"

        # Build and push the Docker image to Docker Hub.
        - DOCKER_IMAGE="$DOCKERHUB_USERNAME/$DOCKERHUB_REPOSITORY:$CI_COMMIT_SHA"
        - docker build --tag "$DOCKER_IMAGE" .
        - docker push "$DOCKER_IMAGE"
    ```
  </Tab>
</Tabs>

## Get help

If you don't see Generic OIDC as a destination in the 1Password desktop app, make sure your administrator has [connected an OIDC provider to your 1Password account](/brokered-access#custom-oidc-provider).

## Learn more

* [1Password Environments](/environments)
* [1Password Credential Broker](/brokered-access)
* [1Password SDKs](/sdks)


## Related topics

- [Allow your team to use 1Password to broker access to secrets in their workflows (public preview)](/brokered-access.md)
- [Use 1Password to broker access to secrets in GitHub Actions at runtime (public preview)](/brokered-access/github-actions.md)
- [Secure SSH and Git workflows with 1Password](/get-started/secure-ssh-git-workflows.md)