Authentication
1Password SDKs support authentication with the 1Password desktop app or with a 1Password Service Account.1Password desktop app
You can build local integrations between 1Password and local applications or scripts that allow end users to authorize access directly on their device with prompts from their 1Password desktop app. Local authorization prompts from the 1Password desktop app allow end users to approve requests from your integration the same way they unlock the app, like with biometrics, their 1Password account password, their identity provider, or other supported methods. Prompts from 1Password clearly detail which account the integration will access, the process requesting access, and the scope and duration of that access. If the user approves, they securely grant the integration temporary access to the entirety of the authorized 1Password account. Access expires after 10 minutes of inactivity or when the user locks their account in the app. This method allows end users to use your integration with minimal setup and no token management, and enables secure, human-in-the-loop approval for sensitive workflows.1Password Service Account
Service accounts enable you to follow the principle of least privilege in your project, and automate access without human approval. Service account tokens are scoped to specific vaults and Environments, and are restricted to specific permissions in each vault. Service accounts aren’t tied to an individual account, and work well in shared environments. They can’t access your built-in Personal, Private, or Employee vaults, and they can only manage permissions for vaults created by the service account.Comparison
Use the following table to decide which authentication method best suits your use case.Autofill behavior
Which credentials 1Password suggests
When you create a Login or Password item, use the following IDs and field types for the credentials you want 1Password to suggest and fill:
See an example of how to create a Login item.
Where a login is suggested and filled
TheItem struct for Login and Password items contains an optional list of websites, so you can manage where 1Password autofills your credentials. Autofill behavior options include:
Environments
1Password Environments allow you to organize and manage your project secrets as environment variables, separately from the items in your 1Password vaults. You can then read the variables from your Environments using 1Password SDKs.Item categories
Items in 1Password have a category that determines some characteristics about the item, like the fields available by default and whether 1Password suggests the item when you sign in to a website. Learn more about the different types of items you can save in 1Password. See supported item categories.Item states
ItemOverview exposes one of two states: Active or Archived.
Field types
1Password SDKs currently support operations on the following field types. You can only retrieve and make changes to supported field types.
If an item contains information saved in unsupported field types, you won’t be able to update or delete the item.
See supported functionality for more information.
Files
Document file
A document file is a file stored in 1Password as a Document item. You can read, save, and replace document files saved in 1Password using the SDKs.Field file
A field file is a file attachment saved in a 1Password item. You can read, save, and remove file attachments saved in 1Password using the SDKs.Query parameters
otp
You can use the otp (or totp) attribute query parameter to retrieve one-time passwords with the Resolve function.
Append the ?attribute=otp query parameter to a secret reference that points to the field where your one-time password is stored. For example:
ssh-format
You can use the ssh-format attribute query parameter to fetch a private SSH key in OpenSSH format using the Resolve function.
Append the ?ssh-format=openssh query parameter to a secret reference that points to the field where your SSH private key is stored. For example: