1Password - Darwin

Darwin can use a 1Password item as a just-in-time authentication source. The secret remains in 1Password; Darwin stores only the connection metadata and opaque item reference required to resolve it during an authorized Action.

This adapter is a planned preview. It is not available in the production API or MCP tool set yet.

Choose a machine-access path

Path	Use it for	Boundary
Service account	Darwin-managed or customer-managed workloads that need selected team vaults	Grant only the vaults and items required for the integration.
1Password Connect	Customer-hosted access through a deployed Connect server	The customer operates the server and controls its vault access token.

These paths do not provide access to the built-in Personal or Private vaults. Darwin never asks for the user’s 1Password account password, Secret Key, recovery material, or an unrestricted export.

Resolve the item just in time

bounded authentication interaction -> op:// item reference -> authorized resolver
                                   -> transient credential -> provider authentication
                          -> discard secret value

Rotation, deletion, and sharing remain controlled by 1Password. Removing the Darwin connection stops future resolution without copying the secret into Darwin Vault. See 1Password service accounts and 1Password Connect for the provider’s current access model.

Last modified on September 22, 2026