1Password for Agents allows you to authorize agents to securely use items from your 1Password account. Agents can request that individual items be filled, and with your approval, the 1Password extension in the agent developer’s browser fills those items directly into a website on your behalf.
1Password for Agents is available for Login items, including one-time password codes, saved in your Personal or Private vault.
This article describes the security model of 1Password for Agents and the risks associated with it.
Security model
The security of 1Password for Agents builds upon the fundamental 1Password security model.
1Password for Agents splits the material needed to decrypt an item between the agent and 1Password. When you connect an agent, 1Password creates a new keyset for the connection and encrypts it with a new integration key, which only the agent developer receives.
When you approve an item, 1Password locally derives a new “client” key from your vault key. 1Password encrypts the vault key for the approved item with the client key, and the agent developer receives an encrypted copy of the client key.
To fill an item, the agent developer uses its integration key to decrypt the connection’s keyset, decrypts the client key, and sends the client key to 1Password’s confidential computing enclave, where it’s used to decrypt your vault key.
Inside the enclave, the vault key is used to decrypt the requested item. The item is then provided to the 1Password extension directly, running inside the agent’s hosted browser runtime.
You own your data. Neither 1Password nor the agent developer ever receives your 1Password account password or Secret Key, and neither can decrypt your data. 1Password for Agents requires the client key, held by the agent developer, to decrypt approved items inside the confidential computing enclave. All vault data is encrypted at rest. Only approved items leave the enclave, and are sent to the 1Password browser extension over an end-to-end encrypted channel.
Authorization model
You approve requests in 1Password. Every new access request opens 1Password, and an agent cannot approve its own requests.
Connecting your account
Before an agent can ask for anything, you connect it to your 1Password account.
You start from the agent’s app and sign in to 1Password. Connecting uses OAuth 2.0 with the protections you’d expect from that flow, following RFC 9700 best practices.
When you connect, 1Password creates a set of keys for the connection and encrypts them with a new key, called the integration key. The integration key is provided to the agent developer and 1Password servers never receive it.
Approving an item
When your agent needs an item it doesn’t have, it creates an access request with 1Password. The request produces an approval prompt in your 1Password app. After you approve, the agent can use the approved items again without prompting you, for a limited time.
Your app must be unlocked to approve an agent’s request for an item. The agent’s request description defines which items are shown in the prompt, and you pick the exact items to allow.
How to stop allowing agents to access your account
To revoke an agent’s access at any time, disconnect the agent on 1Password.com or disconnect 1Password in the agent’s app. On 1Password.com, sign in to your account, select Integrations, then find the agent under “Autofill for AI”. Disconnecting deletes the connection’s keys, every associated approval, and revokes the agent’s access to your account.
Accepted risks
- Submitted credentials belong to the website. Once a form is filled and submitted, item values are in the hands of the site and its scripts. 1Password cannot control what happens from there. This is inherent to signing in, whether a human or an agent initiates it. 1Password fills only items you’ve approved and only on matching pages, submits right away, and clears values from the page if submission fails.
- You trust the agent. The 1Password confidential computing enclave returns an item to the extension when an agent initiates an item fill. After a successful fill, what the agent does on the website is governed by the agent’s own safeguards. 1Password’s guarantees cover the storage, approval, delivery, and filling of credentials, not the agent’s behavior during a session.
- You trust the agent developer. The agent developer stores the authorization tokens and integration key for your connection, and their agent controls the environment into which items are filled. Whether the agent’s model could ever see a credential depends on how the developer builds its service. 1Password reviews some developer architectures and requires encrypted storage of these secrets, but can’t enforce what happens inside third-party systems.
Learn more
Was this article helpful?
Glad to hear it! If you have anything you'd like to add, feel free to contact us.
Sorry to hear that. Please contact us if you'd like to provide more details.