Connect AI agents to 1Password

Scalekit connector

The 1Password connector lets your AI agent act in each user's 1Password account. Each user connects their own 1Password access token once, and Scalekit sends it with every call, so your agent never handles credentials. It comes with 4 tools.

Tools: 4
What they doRead · write · destructive: 4 · 0 · 04 read0 write0 destructive
Users sign in with: Access token

Setup

Install the SDK
- Node.js
- Python
Terminal window
npm install @scalekit-sdk/node dotenv
Terminal window
pip install scalekit-sdk-python python-dotenv
Set your credentials
Add your Scalekit credentials to your .env file. Find values in app.scalekit.com > Developers > API Credentials.
.env
```
SCALEKIT_ENVIRONMENT_URL=<your-environment-url>
SCALEKIT_CLIENT_ID=<your-client-id>
SCALEKIT_CLIENT_SECRET=<your-client-secret>
```
Create the 1Password connection
In AgentKit > Connections, create a 1Password connection. The name you give it is the connection_name your code passes. See Configure connections.

Authorize a user and make your first call

Node.js
Python

1
import { ScalekitClient } from '@scalekit-sdk/node'
2
import 'dotenv/config'
3
import { createInterface } from 'node:readline/promises'
4

5
const scalekit = new ScalekitClient(
6
  process.env.SCALEKIT_ENVIRONMENT_URL,
7
  process.env.SCALEKIT_CLIENT_ID,
8
  process.env.SCALEKIT_CLIENT_SECRET,
9
)
10
const actions = scalekit.actions
11

12
const connector = 'onepassword'
13
const identifier = 'user_123'
14

15
// Generate an authorization link for the user
16
const { link } = await actions.getAuthorizationLink({ connectionName: connector, identifier })
17
console.log('Authorize 1Password:', link)
18
const rl = createInterface({ input: process.stdin, output: process.stdout })
19
await rl.question('Press Enter after authorizing...')
20
rl.close()
21

22
// Make your first call
23
const result = await actions.executeTool({
24
  connector,
25
  identifier,
26
  toolName: 'onepassword_get_token_info',
27
  toolInput: {},
28
})
29
console.log(result)

npx tsx quickstart.mts

1
import os
2
from scalekit import ScalekitClient
3
from dotenv import load_dotenv
4
load_dotenv()
5

6
scalekit_client = ScalekitClient(
7
    env_url=os.getenv("SCALEKIT_ENVIRONMENT_URL"),
8
    client_id=os.getenv("SCALEKIT_CLIENT_ID"),
9
    client_secret=os.getenv("SCALEKIT_CLIENT_SECRET"),
10
)
11
actions = scalekit_client.actions
12

13
connection_name = "onepassword"
14
identifier = "user_123"
15

16
# Generate an authorization link for the user
17
link_response = actions.get_authorization_link(
18
    connection_name=connection_name,
19
    identifier=identifier,
20
)
21
print("Authorize 1Password:", link_response.link)
22
input("Press Enter after authorizing...")
23

24
# Make your first call
25
result = actions.execute_tool(
26
    tool_input={},
27
    tool_name="onepassword_get_token_info",
28
    connection_name=connection_name,
29
    identifier=identifier,
30
)
31
print(result)

python quickstart.py

Each user opens the link once and enters their 1Password credentials there. See Authorize a user for the full flow and statuses.

Tools

Pass the exact name to execute_tool

Try in Playground Request a tool

onepassword_get_token_infoInspect the connected 1Password Events Reporting token.Read-only
Get Token Info
Inspect the connected 1Password Events Reporting token. Returns the token uuid, issued_at timestamp, the account_uuid it belongs to, and its features list (any of signinattempts, itemusages, auditevents). Use it to check which event feeds this connection can read before calling onepassword_list_sign_in_attempts, onepassword_list_item_usages, or onepassword_list_audit_events.
Inputs
This tool takes no inputs.
onepassword_list_audit_eventsList audit events for actions team members took in the 1Password account, such as creating or deleting vaults, granting or revoking vault access, inviting, suspending or removing users, and changing groups, SSO, or MFA settings, within a time range or from a saved cursor.Read-only
List Audit Events
List audit events for actions team members took in the 1Password account, such as creating or deleting vaults, granting or revoking vault access, inviting, suspending or removing users, and changing groups, SSO, or MFA settings, within a time range or from a saved cursor. Returns items with uuid, timestamp, actor_uuid, actor_details, actor_type, action, object_type, object_uuid, object_details, aux fields, session (device, IP address), and location, plus cursor and has_more for paging. Use it for the account's change log; use onepassword_list_item_usages for item access and onepassword_list_sign_in_attempts for logins. The connection's token must include the auditevents feature; check with onepassword_get_token_info.
Inputs
cursorstring
Cursor returned by a previous call to this tool, used to fetch the next page of audit events or to poll for new ones. When set, limit, start_time and end_time are ignored, because the cursor already carries them. Leave empty on the first call. Example: aGVsbG8hIGlzIGl0IG1lIHlvdSBhcmUgbG9va2luZyBmb3IK
end_timestring
Only return audit events that happened before this time, as an RFC 3339 timestamp. Used only when no cursor is set. If omitted, there is no end bound. Example: 2026-10-14T00:00:00Z
limitinteger
Maximum number of audit events to return in one call, from 1 to 1000. Used only when no cursor is set; later pages keep the limit stored in the cursor. 1Password defaults to 100 when omitted. Example: 100
start_timestring
Only return audit events that happened at or after this time, as an RFC 3339 timestamp. Used only when no cursor is set. If omitted, 1Password starts one hour before end_time, or one hour ago when end_time is also omitted. Example: 2026-10-01T00:00:00Z
onepassword_list_item_usagesList each use of an item stored in a shared vault of the 1Password account (fill, reveal, secure-copy, export, share, server-fetch, and others), within a time range or from a saved cursor.Read-only
List Item Usages
List each use of an item stored in a shared vault of the 1Password account (fill, reveal, secure-copy, export, share, server-fetch, and others), within a time range or from a saved cursor. Returns items with uuid, timestamp, vault_uuid, item_uuid, used_version, action, user, client (app, platform, OS, IP address), and location, plus cursor and has_more for paging. Use it to see who accessed or revealed which shared item; use onepassword_list_audit_events for account and vault changes, and onepassword_list_sign_in_attempts for logins. The connection's token must include the itemusages feature; check with onepassword_get_token_info.
Inputs
cursorstring
Cursor returned by a previous call to this tool, used to fetch the next page of item usage events or to poll for new ones. When set, limit, start_time and end_time are ignored, because the cursor already carries them. Leave empty on the first call. Example: aGVsbG8hIGlzIGl0IG1lIHlvdSBhcmUgbG9va2luZyBmb3IK
end_timestring
Only return item usage events that happened before this time, as an RFC 3339 timestamp. Used only when no cursor is set. If omitted, there is no end bound. Example: 2026-10-14T00:00:00Z
limitinteger
Maximum number of item usage events to return in one call, from 1 to 1000. Used only when no cursor is set; later pages keep the limit stored in the cursor. 1Password defaults to 100 when omitted. Example: 100
start_timestring
Only return item usage events that happened at or after this time, as an RFC 3339 timestamp. Used only when no cursor is set. If omitted, 1Password starts one hour before end_time, or one hour ago when end_time is also omitted. Example: 2026-10-01T00:00:00Z
onepassword_list_sign_in_attemptsList successful and failed attempts to sign in to the 1Password account within a time range or from a saved cursor.Read-only
List Sign-In Attempts
List successful and failed attempts to sign in to the 1Password account within a time range or from a saved cursor. Returns items with uuid, session_uuid, timestamp, category (success, credentials_failed, mfa_failed, sso_failed, firewall_failed, and others), type, country, target_user, client (app, platform, OS, IP address), and location, plus cursor and has_more for paging. Use it to investigate sign-in activity or failed logins; use onepassword_list_audit_events for actions taken inside the account, and onepassword_list_item_usages for item access. The connection's token must include the signinattempts feature; check with onepassword_get_token_info.
Inputs
cursorstring
Cursor returned by a previous call to this tool, used to fetch the next page of sign-in attempts or to poll for new ones. When set, limit, start_time and end_time are ignored, because the cursor already carries them. Leave empty on the first call. Example: aGVsbG8hIGlzIGl0IG1lIHlvdSBhcmUgbG9va2luZyBmb3IK
end_timestring
Only return sign-in attempts that happened before this time, as an RFC 3339 timestamp. Used only when no cursor is set. If omitted, there is no end bound. Example: 2026-10-14T00:00:00Z
limitinteger
Maximum number of sign-in attempts to return in one call, from 1 to 1000. Used only when no cursor is set; later pages keep the limit stored in the cursor. 1Password defaults to 100 when omitted. Example: 100
start_timestring
Only return sign-in attempts that happened at or after this time, as an RFC 3339 timestamp. Used only when no cursor is set. If omitted, 1Password starts one hour before end_time, or one hour ago when end_time is also omitted. Example: 2026-10-01T00:00:00Z

Setup

Install the SDK

Set your credentials

Create the 1Password connection

Authorize a user and make your first call

Tools

Call it

Returns

Get Token Info

Inputs

List Audit Events

Inputs

List Item Usages

Inputs

List Sign-In Attempts

Inputs

Related: other Monitoring connectors