Skip to main content

​
Requirements

Before you can use 1Password CLI to add and remove team members, you’ll need to:
  1. Sign up for 1Password Business.
  2. Install 1Password CLI.
If you use automated provisioning hosted by 1Password, you’ll also need to complete a one-time setup before managing users with the CLI.

​
Set up provisioning

​
With automated provisioning

Support for automated provisioning hosted by 1Password is available in the latest beta build of 1Password CLI, version 2.36.0-beta-02 or later.
If your account uses automated provisioning hosted by 1Password, you’ll need to run a one-time setup command before you can manage users with the CLI. Skip this section if your account doesn’t use automated provisioning. Run op provisioning configure with your provisioning token and SCIM URL. The --token value must be a secret reference that points to the vault, item, and field where your token is stored in your 1Password account (for example, op://vault-name/item-name/field-name). The --url flag accepts the SCIM URL as plaintext or as a secret reference. For example: 
op provisioning configure --token <token> --url <url>
After you create users with the CLI with automated provisioning enabled, automated provisioning must remain enabled on the account. Users created this way are placed in provisioning-specific states. If automated provisioning is removed from the account, the CLI will return an error when attempting to suspend or reactivate those users.

​
With 1Password CLI

If you don’t use automated provisioning, an owner or administrator must visit the Provisioning settings page on 1Password.com and select Turn On CLI Provisioning. This will create a Provision Managers group with the permissions needed to provision and confirm team members, as well as recover accounts. The person who created the group will be added to it.

​
Manage who can provision team members

By default, the owner or administrator who created the Provision Managers group is the only person added to it. If other team members need to be able to provision users, use op group user grant to add them to the group. For example, to add Wendy Appleseed to the Provision Managers group: 
op group user grant --group "Provision Managers" --user "wendy.appleseed@agilebits.com"
To see a list of everyone in the Provision Managers group: 
op group user list "Provision Managers"

​
Add team members

To invite people to your team, use op user provision with the team member’s name and email address. For example, to invite Wendy Appleseed to join your 1Password account: 
op user provision --name "Wendy Appleseed" --email "wendy.appleseed@agilebits.com"
The person will receive an email invitation to join the team. After they’ve accepted the invitation, a member of the Provision Managers group can confirm them.

​
Confirm team members

If your account uses automated provisioning, users are confirmed automatically. You can skip this section.
Anyone who belongs to the Provision Managers group can confirm new team members with op user confirm or on 1Password.com.

​
With op user confirm

To confirm a team member on the command line, use op user confirm with their name or email address. To confirm all unconfirmed team members, include the --all flag. For example, to confirm Wendy Appleseed: 
op user confirm "wendy.appleseed@agilebits.com"
To confirm all pending users: 
op user confirm --all

​
On 1Password.com

To confirm a team member on 1Password.com:
  1. Sign in to your account on 1Password.com.
  2. Select People in the sidebar.
  3. Select the name of any team member with the Pending Provision status.
  4. Select Confirm or Reject.
If you don’t see the option to confirm or reject a team member, ask your administrator to add you to the Provision Managers group.

​
Remove team members

To remove someone’s access to vaults and items, you can suspend or delete their account.

​
Suspend an account temporarily

Use op user suspend to suspend a team member temporarily. Include the --deauthorize-devices-after flag, followed by the number of seconds, minutes, or hours (for example, 600s, 10m, or 1h) to set the time after suspension to deauthorize the suspended team member’s devices. The maximum time permitted is 24 hours. If unspecified, their devices will be deauthorized immediately.
If your account uses automated provisioning, the --deauthorize-devices-after flag is ignored. The provisioning service always deauthorizes devices after 10 minutes.
For example, to suspend Wendy Appleseed temporarily and deauthorize her devices after 10 minutes: 
op user suspend "wendy.appleseed@agilebits.com --deauthorize-devices-after 10m"
You can reactivate a suspended user with op user reactivate.

​
Remove an account permanently

Use op user delete to permanently remove a team member’s access to vaults and items and delete all of their data from the account. For example, to remove Wendy Appleseed: 
op user delete "wendy.appleseed@agilebits.com"

​
Learn more