1Password

Overview

By the end of this guide, you’ll have an authenticated Intuned project that uses credentials stored securely in 1Password. You’ll learn how to:

Set up a 1Password account and create a vault for Intuned to access.
Set up a 1Password Service Account to access your vault programmatically.
Enable and configure 1Password integration in your Intuned project.
Create AuthSessions using credentials from 1Password.

Prerequisites

Before you begin, ensure you have the following:

An active Intuned account.
A 1Password account with permissions to create vaults and service accounts.

This guide assumes you have a basic understanding of Intuned Projects and AuthSessions. If you’re new to Intuned, start with the getting started guide.

When to use 1Password integration

When you create an AuthSession, you provide credentials for logging into the target website. Intuned stores these credentials securely to renew the AuthSession when it expires. However:

You may prefer not to store sensitive credentials directly in Intuned.
If credentials change frequently, you need to update them manually through Intuned APIs.
Sharing credentials across Projects or AuthSessions requires duplicating them.

With 1Password integration, you can:

Keep credentials in 1Password instead of Intuned.
Fetch the latest credentials automatically when needed.
Share credentials across Projects and AuthSessions without duplication.

You can use 1Password both in deployed Projects and while you build them with the Intuned Agent or the CLI. See Use 1Password during development.

Guide

1. Create a 1Password Vault with credentials

1Password App (Desktop)
1password.com
1Password CLI

Open the 1Password app and sign in to your account.
Under Vaults, select +.
Enter name: intuned-automation-credentials and optionally a description.
Select Create.
Add a new item:
- Select Login
- Name it example-login
- Username: demo@email.com
- Password: DemoUser2024!

Go to 1password.com and sign in to your account.
From your account home page, select + New Vault.
Enter name: intuned-automation-credentials and optionally a description.
Select Create Vault.
Add a new item to the vault:
- Select Login
- Name it example-login
- Username: demo@email.com
- Password: DemoUser2024!

Install the latest version of 1Password CLI and sign in to your account.

op signin

Create a vault:

op vault create "intuned-automation-credentials" --description "Vault for Intuned AuthSession credentials"

Add item to the vault:

op item create \
  --vault='intuned-automation-credentials' \
  --title='example-login' \
  --category=login \
  "username=demo@email.com" \
  "password[password]=DemoUser2024!"

You now have two 1Password items: op://intuned-automation-credentials/example-login/username and op://intuned-automation-credentials/example-login/password. You’ll use these paths later to reference the credentials in Intuned.

For more details, refer to the official 1Password documentation on creating vaults.

2. Create a 1Password Service Account

Creating a service account requires admin access to your 1Password account.

1password.com
1Password CLI

Open the 1Password service account creation wizard.
Follow the instructions:
1. Enter a name for your service account.
2. Choose the vault you created earlier.
3. Make sure you give read access to the vault.
4. Select Create Account.
5. (Optional) Select Save in 1Password to save the service account token in your 1Password account.

You can later access your service account under Developer from your 1Password account home screen.

Copy the service account token and store it securely (preferably in 1Password). You won’t be able to view it again.

Create a service account and assign it to your vault:

op service-account create "<service-account-name>" \
  --vault "intuned-automation-credentials:read_items"

Copy the service account token.

Copy the service account token and store it securely (preferably in 1Password). The 1Password CLI returns it only once.

For more details, refer to the official 1Password documentation on creating service accounts.

1Password Service Accounts have rate limits. Intuned reads from the vault when creating or renewing AuthSessions, and each time your code calls getAuthSessionParameters. Check out 1Password service account rate limits for more details.

3. Set up 1Password Service Account Token on Intuned

Set up your 1Password Service Account token as a Workspace Environment Variable:

Go to Workspace Settings > Environment Variables.
Create a new variable with:
- Key: OP_SERVICE_ACCOUNT_TOKEN
- Value: Your 1Password Service Account token from step 2.
- Environments: Deployed environment, so deployed Projects can read from 1Password. Also select Development environment to use the token with the Intuned Agent and the CLI while you build.

Set up 1Password Service Account token as Environment Variable

You can set up the token as a Project Environment Variable if you do not want to share the 1Password Service Account across Projects. Check out Project-level environment variables for more details.

For security reasons, OP_SERVICE_ACCOUNT_TOKEN will not be exposed to your automation code. If you want to use the 1Password SDK in your code, use a different environment variable key at your own risk.

4. Create a Project with AuthSessions and 1Password integration enabled

For this guide, we use the Book consultations authenticated quickstart project which is the rpa-auth-example template. Follow the quickstart guide to create it. You should now have a project named book-consultations-authenticated-quickstart. Let’s enable 1Password integration for the Project and deploy it.

Online IDE
CLI

Open your project in the IDE. From Files, select Intuned.json, then enable 1Password integration. Optionally add an integration name and version.

In your local project folder, open your Intuned settings file and enable 1Password integration. Optionally add an integration name and version.

{
  // rest of settings
  "integrations": { 
    "1password": {
      "enabled": true,
      "integrationName": "<optional-integration-name>", 
      "integrationVersion": "<optional-integration-version>"
    }
  }
}

{
  // rest of settings
  "integrations": { 
    "1password": {
      "enabled": true,
      "integrationName": "<optional-integration-name>", 
      "integrationVersion": "<optional-integration-version>"
    }
  }
}

The integrationName and integrationVersion fields are optional identifiers used by the 1Password SDK for tracking.

1Password references are resolved only for credentials-based AuthSessions, so AuthSessions must be enabled with type API in your Intuned settings.

Deploy your project for the changes to take effect.

5. Create an AuthSession using 1Password credentials

API
Dashboard

await intuned.projects.authSessions.create.start(
  "book-consultations-authenticated-quickstart",
  {
    id: "1password-example",
    parameters: {
      "username": "op://intuned-automation-credentials/example-login/username",
      "password": "op://intuned-automation-credentials/example-login/password"
    }
  },
);

from intuned_client import models

intuned.projects.auth_sessions.create.start(
  project_name="book-consultations-authenticated-quickstart",
  body=models.AuthSessionsCreateStartRequestBody(
    id="1password-example",
    parameters={
      "username": "op://intuned-automation-credentials/example-login/username",
      "password": "op://intuned-automation-credentials/example-login/password"
    }
  )
)

From your project > AuthSessions, select + Session. Let’s name it 1password-example. When you enter the parameters, enter the 1Password credential path instead of the actual credentials.

{
  "username": "op://intuned-automation-credentials/example-login/username",
  "password": "op://intuned-automation-credentials/example-login/password"
}

username: op://intuned-automation-credentials/example-login/username
password: op://intuned-automation-credentials/example-login/password

Intuned will securely fetch the credentials from 1Password and pass them to your auth-sessions/create function to create the AuthSession.

Create AuthSession with 1Password paths as credentials

6. Use the AuthSession in your API

API
Dashboard (Playground)

await intuned.projects.runs.start(
  projectName,
  {
    api: "book-consultations",
    parameters: {
      name: "Foo Bar",
      email: "foo@bar.com",
      phone: "1234567890",
      date: "2026-11-19",
      time: "10:00 AM",
      topic: "other"
    },
    authSession: {
      id: "1password-example",
    },
  }
);

from intuned_client import models

intuned.projects.runs.start(
  project_name=project_name,
  body=models.RunStartRequestBody(
    api="book-consultations",
    parameters={
      "name": "Foo Bar",
      "email": "foo@bar.com",
      "phone": "1234567890",
      "date": "2026-11-19",
      "time": "10:00 AM",
      "topic": "other"
    },
    auth_session={
      "id": "1password-example"
    },
  ),
)

From the dashboard, go to your project > Runs > Start Run. Select book-consultations, enter the parameters:

{
  "name": "Foo Bar",
  "email": "foo@bar.com",
  "phone": "1234567890",
  "date": "2026-11-19",
  "time": "10:00 AM",
  "topic": "other"
}

Select the AuthSession 1password-example you created earlier. Select Start Run.

Use 1Password Auth Session in Run Playground

Read credentials in your code

Inside auth-sessions/create, the parameters your function receives already hold the real values. If your code needs them elsewhere, such as in auth-sessions/check or an API, call getAuthSessionParameters (TypeScript, Python). When 1Password is enabled, it returns the values from 1Password instead of the op:// references.

Every call to getAuthSessionParameters reads from 1Password and counts toward your service account’s rate limits. Call it once per run and reuse the result rather than calling it in a loop.

Use 1Password during development

The same op:// references work while you build and test a Project. Intuned stores the references, never the secrets, and reads the values from 1Password before each AuthSession create, check, or API run.

With the Intuned Agent

Set OP_SERVICE_ACCOUNT_TOKEN as a workspace or Project environment variable tagged Development environment (see step 3).
In the Online IDE, enable 1Password in Intuned.json as in step 4.
When the agent asks for credentials, enter op:// references instead of the real values.

The agent runs your AuthSessions through the CLI, which resolves the references with that token as described below. The agent never sees the token or the resolved values.

The references are resolved only when an AuthSession runs. If the agent fills a login form directly while exploring the site, it types the reference text, not the secret.

With the CLI

Enable 1Password in your Intuned settings as in step 4, then use op:// references in your AuthSession parameter files. Before each attempt, the CLI tries these sources in order and uses the first one that resolves every reference:

OP_SERVICE_ACCOUNT_TOKEN set in your shell or in the Project’s .env file. This needs Node.js and the 1Password JavaScript SDK, installed in the Project or globally with npm install -g @1password/sdk.
The workspace or Project OP_SERVICE_ACCOUNT_TOKEN environment variable tagged Development environment. A Project token takes priority over a workspace token.
The 1Password CLI (op), using your own sign-in.

If none of them works, the run fails and lists the error from each source. Set up one of the sources, or set integrations.1password.enabled to false to stop resolving references. Files on disk, such as .parameters/ and saved AuthSession instances, keep the op:// references. OP_SERVICE_ACCOUNT_TOKEN is never passed to your automation code, even when it comes from .env.

Deploy your first authenticated RPA

Step-by-step guide to creating your first authenticated RPA project

AuthSessions

Learn more about AuthSessions in Intuned

Getting started

Intuned Agent

Web Tasks

Platform features

Learn

How-To

Integrations

References

Resources

Overview

Prerequisites

When to use 1Password integration

Guide

1. Create a 1Password Vault with credentials

2. Create a 1Password Service Account

3. Set up 1Password Service Account Token on Intuned

4. Create a Project with AuthSessions and 1Password integration enabled

5. Create an AuthSession using 1Password credentials

6. Use the AuthSession in your API

Read credentials in your code

Use 1Password during development

With the Intuned Agent

With the CLI

Deploy your first authenticated RPA

AuthSessions

​Overview

​Prerequisites

​When to use 1Password integration

​Guide

​1. Create a 1Password Vault with credentials

​2. Create a 1Password Service Account

​3. Set up 1Password Service Account Token on Intuned

​4. Create a Project with AuthSessions and 1Password integration enabled

​5. Create an AuthSession using 1Password credentials

​6. Use the AuthSession in your API

​Read credentials in your code

​Use 1Password during development

​With the Intuned Agent

​With the CLI

​Related resources

Deploy your first authenticated RPA

AuthSessions

Overview

Prerequisites

When to use 1Password integration

Guide

1. Create a 1Password Vault with credentials

2. Create a 1Password Service Account

3. Set up 1Password Service Account Token on Intuned

4. Create a Project with AuthSessions and 1Password integration enabled

5. Create an AuthSession using 1Password credentials

6. Use the AuthSession in your API

Read credentials in your code

Use 1Password during development

With the Intuned Agent

With the CLI

Related resources