1Password Service Accounts - 1Password Developer

1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional services. Service accounts work well for shared environments because they provide an authentication method for 1Password CLI that isn’t associated with an individual. You control which vaults and Environments are accessible and which actions the service account can perform. And you can see what items a service account accesses by creating a usage report. You can create up to 100 service accounts.

How service accounts compare

1Password gives you three ways to authenticate automated workflows, each with a different trade-off:

	Service accounts	Connect server	Credential Broker (public preview)
What it is	A token scoped to specific vaults or Environments	A self-hosted REST API you deploy in your own infrastructure	No token at all — access is verified per run using your CI/CD platform’s OIDC identity
Setup	Create a token, no infrastructure to run	Deploy and maintain a Connect server	An admin sets up a trust policy once; no secret to store
Best for	Most CI/CD pipelines, scripts, and shared builds	High-volume or low-latency access, since requests are served from your own infrastructure after the first fetch	GitHub Actions or custom OIDC workflows where you’d rather not manage a token at all
Limits	Subject to rate limits and request quotas	Requires infrastructure to run and maintain	Public preview; currently supports GitHub Actions and custom OIDC workflows

See the full secrets automation comparison table for Connect, or set up Credential Broker if you’d rather not manage tokens at all.

Use cases

You can use 1Password Service Accounts to accomplish a variety of tasks:

Get started

Learn how to get started and how to create, manage, and integrate with service accounts.

Next steps

Create a service account and scope it to the vaults or Environments it needs.
Rotate a service account token on a schedule or after a potential exposure.
Load secrets into CI/CD pipelines with a service account instead of a personal account.
Compare service accounts with Connect servers and Credential Broker.

Get help

To get help, join the discussion in our Developer community or join our Developer Slack workspace.

​How service accounts compare

​Use cases

​Get started

​Next steps

​Get help

How service accounts compare

Use cases

Get started

Next steps

Get help