Secrets pour agents (1Password, Vault)
Tool : A precise action the AI can call · requires 1password
Provide secrets to an agent without putting them in the prompt.
Essential as soon as an agent has keys; never put a secret in the context.
Security reflects where data goes, requested permissions and incidents on record at the verification date. It is not a guarantee of zero risk: check the deployment mode and the connections you enable.
What it does, concretely
When an AI agent needs to call an external API, it requires keys or passwords. Storing them in the prompt or in source code exposes them to anyone who reads the logs or the repository. The 1Password SDK solves this by letting the agent retrieve secrets directly from a 1Password vault, without ever writing them in plain text in the context.
In practice, the agent authenticates with 1Password via a service account whose token is itself stored in an environment variable. It can then read, create, or share items in the vaults that account has access to. SDKs are available in Go, JavaScript, and Python, and can be installed with a single command.
This tool is aimed at developers building agents or automated pipelines that need secure access to secrets. It also suits teams that want precise audit trails of which accesses were made and by which account.
It is not suited for non-technical users looking for a no-code, turnkey solution. The SDKs are still in version 0, which means potentially breaking changes between major minor versions.
What it offers
- ·Read secrets from a 1Password vault via a reference, without exposing them in code or the prompt. (paid)
- ·Service account authentication with a token stored in an environment variable for automated workflows. (paid)
- ·Authentication via the 1Password desktop app with biometric validation for local integrations. (paid)
- ·Programmatic item management: create, update, and share items in vaults. (paid)
- ·Vault and group permission management within a 1Password account. (paid)
- ·Secure item sharing with people who do not have a 1Password account. (paid)
- ·Available in three languages: Go, JavaScript, and Python, installable via standard package managers.
In practice
- Price
- Paid
- Commercial use
- Commercial use: yes
- Available on
- sdk, mcp
- Host
- 1password
- FR interface
- No
Security and data
- Rating
- Security: one caveat, see the card
- Capabilities
- readswritesexecutesnetwork
- Your data
- Data with the vendor
- Maintenance
- Active
Links and repository checked on 25 October 2026 · added on 1 June 2024
How to install Secrets pour agents (1Password, Vault)
pip install onepassword-sdk