Skip to main content
1Password Connect servers are a type of Secrets Automation workflow that allows you to securely access your 1Password items and vaults in your company’s apps and cloud infrastructure.

​
Requirements

Before you can create a 1Password Secrets Automation workflow as a Connect server, make sure you complete the prerequisite tasks. The tasks vary depending on how you plan to deploy.

​
Deployment

Use the following instructions to deploy a 1Password Connect Server.

​
Step 1: Create a Secrets Automation workflow

You can create a Connect server Secrets Automation workflow through the 1Password.com dashboard or 1Password CLI. Following these instructions creates:
  • A 1password-credentials.json file. It contains the credentials necessary to deploy 1Password Connect Server.
  • An access token. Use this in your applications or services to authenticate with the Connect REST API. You can issue additional tokens later.
  1. Sign in to your account on 1Password.com.
  2. Open the Secrets Automation workflow creation wizard.
    Or, navigate to Developer > Directory, select Other under Infrastructure Secrets Management, then select Create a Connect server.
  3. Follow the onscreen instructions to create a Secrets Automation environment, set up your first access token, and deploy a Connect server. Make sure to save your credentials file and token in 1Password.
You can find your new Secrets Automation workflow under “Connect servers” on the Developer page.
Export your Connect server access token as an environment variable. Doing so might prove useful if you decide to configure another tool like the Kubernetes Injector, Kubernetes Operator, or other integrations. However, keep in mind that the recommended way to use the Connect server token with Kubernetes is as a Kubernetes Secret.
export OP_CONNECT_TOKEN=<token>

​
Step 2: Deploy a 1Password Connect Server

To deploy a Connect server using a Docker Compose file, you’ll need to start two Docker images:
If you aren’t familiar with Docker or Docker Compose, refer to the Docker Compose documentation for more information.
  1. Make sure you have Docker and Docker Compose on your machine.
  2. Create a Docker Compose file to deploy the 1Password Connect Server containers in the directory where you saved your 1password-credentials.json file. You can also use the example docker-compose.yaml file. If the credentials file is in the other directory, update the volumes section to point to the correct credentials file location.
    You can set any of the Connect server environment variables in the docker-compose.yaml file by adding an environment attribute to each container. Doing so lets you specify things like the 1password-credentials.json file location, the log level, and the HTTP port. Refer to the Docker environment attribute documentation for more information.
  3. Make sure Docker is running. You can check if the Docker daemon is running with the docker info command in a terminal application.
  4. Start the Docker containers with Docker Compose. Run the following command in the directory with the docker-compose.yaml file. 
    docker compose up
    You can run the containers in the background using the -detach flag or the -d flag. Refer to the docker compose up reference for more information.
    By default, you can access the Connect REST API through port 8080 on the local host. Refer to the 1Password Connect server API reference for more information.

​
Test the Connect server REST API

You can make sure the Connect server REST API is accessible using a curl command, one of the 1Password Connect server API endpoints, and the token you created.
  1. Export the Connect server access token as an environment variable. This is the same token you created in Step 1. Alternatively, you can replace $OP_API_TOKEN with the token string in the curl request.
    If you forgot your token, you can create another one with the op connect token create command.
    export OP_API_TOKEN="<token>"
  2. Use the following example curl command to list the vaults connected to the Connect server. 
    curl \
    -H "Accept: application/json" \
    -H "Authorization: Bearer $OP_API_TOKEN" \
    http://localhost:8080/v1/vaults
To stop the Docker containers, run docker compose down.

​
Step 3: Set up applications and services to get information from 1Password

Applications and services get information from 1Password through REST API requests to a Connect server. The requests are authenticated with an access token. Create a new token for each application or service you use.
If your language or platform isn’t listed, you can build your own client using the 1Password Connect Server REST API. You can also use 1Password CLI with your Connect server to provision secrets and retrieve item information on the command line.

​
Get help

To change the vaults a token has access to, issue a new token. To get help and share feedback, join the discussion with the 1Password Support Community.