Machine and AI agent credential runtime access
Verify AI agents and machine workloads at runtime, then deliver only the credentials each is authorized to receive.
Keep credentials out of pipelines
Workloads don't hold long-lived credentials. They prove who they are and get only the credentials they are approved to receive at runtime.
The platform identifies the job
Credential Broker checks the workload's identity against your policy, then delivers the exact credentials that specific job is approved for.
Limited potential blast radius
If compromised, access is limited to what 1Password authorized for that job. Blast radius is limited and does not compromise the entire vault.
Full attribution on every delivery
Every credential delivery is logged with full attribution: the workload that requested access, and the policy that authorized it.
Connect your workflows
Start with GitHub Actions
Any workflow running on GitHub Actions can prove its identity to 1Password and receive the exact credentials it's approved for, with no service account token required and full attribution on every delivery.
Set up GitHub Actions
Go further with custom OIDC connections
Any system that issues an OIDC token can authenticate directly to 1Password and retrieve only the credentials it's approved for. No service account tokens or secrets sit stored your environment, and every delivery carries full attribution.
Configure a custom OIDC workflowCredential Broker is part of the Unified Access platform
The platform that discovers, secures, and audits access across every identity.
Credential Broker FAQs
What is 1Password Credential Broker?
1Password Credential Broker authenticates machine workloads and AI agents at runtime, then delivers exactly the credentials they're approved for. Workloads prove who they are and get what policy allows, with no standing vault access.
How does 1Password Credential Broker keep secrets secure?
What gets logged when 1Password Credential Broker delivers a credential?
How does 1Password Credential Broker verify a workload's identity?
Does 1Password Credential Broker work with GitHub Actions?
Is 1Password Credential Broker generally available?
Runtime access for every machine and AI agent starts with 1Password
Meet with a member of our team to discuss how 1Password Credential Broker can extend your existing 1Password foundation to every workload and AI agent.