> **Building with AI coding agents?** Install the authstack plugin with one command. This equips your agent with accurate Scalekit implementation patterns. > > **Recommended** (the `-y` flags skip prompts, so the command runs without an interactive terminal): > ```bash > npx -y @scalekit-inc/cli setup -y > ``` > > Global: > ```bash > npm install -g @scalekit-inc/cli > scalekit setup -y > ``` > > Supports Claude Code, Cursor, GitHub Copilot, Codex + skills for other Agent Skills-compatible agents in `~/.agents/skills`. > Skills: integrate-agentkit, implement-saaskit, add-mcp-oauth, implement-sso, implement-scim. > [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/) --- # Connect AI agents to 1Password The 1Password connector lets your AI agent act in each user's 1Password account. Each user connects their own 1Password access token once, and Scalekit sends it with every call, so your agent never handles credentials. It comes with 4 tools. **Authentication:** Bearer Token **Categories:** Monitoring **Tools:** 4: 4 read, 0 write, 0 destructive **Users sign in with:** Access token **Built by:** Scalekit connector **Try it:** [Playground in the Scalekit dashboard](https://app.scalekit.com/ws/signup?sk_intent=playground&provider=ONEPASSWORD) ## Setup 1. ### Install the SDK **Node.js** ```bash npm install @scalekit-sdk/node dotenv ``` **Python** ```bash pip install scalekit-sdk-python python-dotenv ``` 2. ### Set your credentials Add your Scalekit credentials to your `.env` file. Find values in **[app.scalekit.com](https://app.scalekit.com)** > **Developers** > **API Credentials**. ```sh title=".env" SCALEKIT_ENVIRONMENT_URL= SCALEKIT_CLIENT_ID= SCALEKIT_CLIENT_SECRET= ``` 3. ### Create the 1Password connection In **AgentKit > Connections**, create a 1Password connection. The name you give it is the `connection_name` your code passes. See [Configure connections](/agentkit/connections/). 4. ### Authorize a user and make your first call **Node.js** (`quickstart.mts`) ```typescript import { ScalekitClient } from '@scalekit-sdk/node' import 'dotenv/config' import { createInterface } from 'node:readline/promises' const scalekit = new ScalekitClient( process.env.SCALEKIT_ENVIRONMENT_URL, process.env.SCALEKIT_CLIENT_ID, process.env.SCALEKIT_CLIENT_SECRET, ) const actions = scalekit.actions const connector = 'onepassword' const identifier = 'user_123' // Generate an authorization link for the user const { link } = await actions.getAuthorizationLink({ connectionName: connector, identifier }) console.log('Authorize 1Password:', link) const rl = createInterface({ input: process.stdin, output: process.stdout }) await rl.question('Press Enter after authorizing...') rl.close() // Make your first call const result = await actions.executeTool({ connector, identifier, toolName: 'onepassword_get_token_info', toolInput: {}, }) console.log(result) ``` ```bash npx tsx quickstart.mts ``` **Python** (`quickstart.py`) ```python import os from scalekit import ScalekitClient from dotenv import load_dotenv load_dotenv() scalekit_client = ScalekitClient( env_url=os.getenv("SCALEKIT_ENVIRONMENT_URL"), client_id=os.getenv("SCALEKIT_CLIENT_ID"), client_secret=os.getenv("SCALEKIT_CLIENT_SECRET"), ) actions = scalekit_client.actions connection_name = "onepassword" identifier = "user_123" # Generate an authorization link for the user link_response = actions.get_authorization_link( connection_name=connection_name, identifier=identifier, ) print("Authorize 1Password:", link_response.link) input("Press Enter after authorizing...") # Make your first call result = actions.execute_tool( tool_input={}, tool_name="onepassword_get_token_info", connection_name=connection_name, identifier=identifier, ) print(result) ``` ```bash python quickstart.py ``` Each user opens the link once and enters their 1Password credentials there. See [Authorize a user](/agentkit/tools/authorize/) for the full flow and statuses. ## Tools Pass the exact name to `execute_tool`, with an input like each tool's example. To ask for a tool that's missing, use the [request form](https://scalekitsupport.portal.usepylon.com/forms/request-a-connector-tool). **Node.js** ```typescript const result = await actions.executeTool({ toolName: 'onepassword_get_token_info', toolInput: {}, connector: 'onepassword', identifier: 'user_123', }) ``` **Python** ```python result = actions.execute_tool( tool_name="onepassword_get_token_info", tool_input={}, connection_name="onepassword", identifier="user_123", ) ``` `result.data` is the app's response as JSON, and `result.execution_id` (`executionId` in Node.js) is the ID of the call. ### `onepassword_get_token_info` Get Token Info · Read-only Inspect the connected 1Password Events Reporting token. Returns the token uuid, issued_at timestamp, the account_uuid it belongs to, and its features list (any of signinattempts, itemusages, auditevents). Use it to check which event feeds this connection can read before calling onepassword_list_sign_in_attempts, onepassword_list_item_usages, or onepassword_list_audit_events. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: none. Example input: `{}` ### `onepassword_list_audit_events` List Audit Events · Read-only List audit events for actions team members took in the 1Password account, such as creating or deleting vaults, granting or revoking vault access, inviting, suspending or removing users, and changing groups, SSO, or MFA settings, within a time range or from a saved cursor. Returns items with uuid, timestamp, actor_uuid, actor_details, actor_type, action, object_type, object_uuid, object_details, aux fields, session (device, IP address), and location, plus cursor and has_more for paging. Use it for the account's change log; use onepassword_list_item_usages for item access and onepassword_list_sign_in_attempts for logins. The connection's token must include the auditevents feature; check with onepassword_get_token_info. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `cursor` (`string`, optional): Cursor returned by a previous call to this tool, used to fetch the next page of audit events or to poll for new ones. When set, limit, start_time and end_time are ignored, because the cursor already carries them. Leave empty on the first call. Example: aGVsbG8hIGlzIGl0IG1lIHlvdSBhcmUgbG9va2luZyBmb3IK - `end_time` (`string`, optional): Only return audit events that happened before this time, as an RFC 3339 timestamp. Used only when no cursor is set. If omitted, there is no end bound. Example: 2026-10-14T00:00:00Z - `limit` (`integer`, optional): Maximum number of audit events to return in one call, from 1 to 1000. Used only when no cursor is set; later pages keep the limit stored in the cursor. 1Password defaults to 100 when omitted. Example: 100 - `start_time` (`string`, optional): Only return audit events that happened at or after this time, as an RFC 3339 timestamp. Used only when no cursor is set. If omitted, 1Password starts one hour before end_time, or one hour ago when end_time is also omitted. Example: 2026-10-01T00:00:00Z Example input: `{}` ### `onepassword_list_item_usages` List Item Usages · Read-only List each use of an item stored in a shared vault of the 1Password account (fill, reveal, secure-copy, export, share, server-fetch, and others), within a time range or from a saved cursor. Returns items with uuid, timestamp, vault_uuid, item_uuid, used_version, action, user, client (app, platform, OS, IP address), and location, plus cursor and has_more for paging. Use it to see who accessed or revealed which shared item; use onepassword_list_audit_events for account and vault changes, and onepassword_list_sign_in_attempts for logins. The connection's token must include the itemusages feature; check with onepassword_get_token_info. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `cursor` (`string`, optional): Cursor returned by a previous call to this tool, used to fetch the next page of item usage events or to poll for new ones. When set, limit, start_time and end_time are ignored, because the cursor already carries them. Leave empty on the first call. Example: aGVsbG8hIGlzIGl0IG1lIHlvdSBhcmUgbG9va2luZyBmb3IK - `end_time` (`string`, optional): Only return item usage events that happened before this time, as an RFC 3339 timestamp. Used only when no cursor is set. If omitted, there is no end bound. Example: 2026-10-14T00:00:00Z - `limit` (`integer`, optional): Maximum number of item usage events to return in one call, from 1 to 1000. Used only when no cursor is set; later pages keep the limit stored in the cursor. 1Password defaults to 100 when omitted. Example: 100 - `start_time` (`string`, optional): Only return item usage events that happened at or after this time, as an RFC 3339 timestamp. Used only when no cursor is set. If omitted, 1Password starts one hour before end_time, or one hour ago when end_time is also omitted. Example: 2026-10-01T00:00:00Z Example input: `{}` ### `onepassword_list_sign_in_attempts` List Sign-In Attempts · Read-only List successful and failed attempts to sign in to the 1Password account within a time range or from a saved cursor. Returns items with uuid, session_uuid, timestamp, category (success, credentials_failed, mfa_failed, sso_failed, firewall_failed, and others), type, country, target_user, client (app, platform, OS, IP address), and location, plus cursor and has_more for paging. Use it to investigate sign-in activity or failed logins; use onepassword_list_audit_events for actions taken inside the account, and onepassword_list_item_usages for item access. The connection's token must include the signinattempts feature; check with onepassword_get_token_info. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `cursor` (`string`, optional): Cursor returned by a previous call to this tool, used to fetch the next page of sign-in attempts or to poll for new ones. When set, limit, start_time and end_time are ignored, because the cursor already carries them. Leave empty on the first call. Example: aGVsbG8hIGlzIGl0IG1lIHlvdSBhcmUgbG9va2luZyBmb3IK - `end_time` (`string`, optional): Only return sign-in attempts that happened before this time, as an RFC 3339 timestamp. Used only when no cursor is set. If omitted, there is no end bound. Example: 2026-10-14T00:00:00Z - `limit` (`integer`, optional): Maximum number of sign-in attempts to return in one call, from 1 to 1000. Used only when no cursor is set; later pages keep the limit stored in the cursor. 1Password defaults to 100 when omitted. Example: 100 - `start_time` (`string`, optional): Only return sign-in attempts that happened at or after this time, as an RFC 3339 timestamp. Used only when no cursor is set. If omitted, 1Password starts one hour before end_time, or one hour ago when end_time is also omitted. Example: 2026-10-01T00:00:00Z Example input: `{}` ## Related Other Monitoring connectors ([all 29](/agentkit/connectors/?category=monitoring)): - [Microsoft Entra ID](/agentkit/connectors/microsoftentraid/): Scalekit connector, OAuth, 82 tools - [Datadog](/agentkit/connectors/datadog/): Scalekit connector, API key, 105 tools - [Malwarebytes](/agentkit/connectors/malwarebytes/): Scalekit connector, Service account, 74 tools --- ## More Scalekit documentation | Resource | What it contains | When to use it | |----------|-----------------|----------------| | [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content | | [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas | | [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |