> ## Documentation Index
> Fetch the complete documentation index at: https://darwin.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# 1Password

> Resolve an authorized 1Password item without importing it into Darwin.

Darwin can use a 1Password item as a just-in-time authentication source. The secret remains in 1Password; Darwin stores only the connection metadata and opaque item reference required to resolve it during an authorized Action.

<Note>
  This adapter is a planned preview. It is not available in the production API or MCP tool set yet.
</Note>

## Choose a machine-access path

| Path              | Use it for                                                                  | Boundary                                                              |
| ----------------- | --------------------------------------------------------------------------- | --------------------------------------------------------------------- |
| Service account   | Darwin-managed or customer-managed workloads that need selected team vaults | Grant only the vaults and items required for the integration.         |
| 1Password Connect | Customer-hosted access through a deployed Connect server                    | The customer operates the server and controls its vault access token. |

These paths do not provide access to the built-in Personal or Private vaults. Darwin never asks for the user's 1Password account password, Secret Key, recovery material, or an unrestricted export.

## Resolve the item just in time

```text theme={null}
bounded authentication interaction -> op:// item reference -> authorized resolver
                                   -> transient credential -> provider authentication
                          -> discard secret value
```

Rotation, deletion, and sharing remain controlled by 1Password. Removing the Darwin connection stops future resolution without copying the secret into Darwin Vault.

See [1Password service accounts](https://developer.1password.com/docs/service-accounts/) and [1Password Connect](https://developer.1password.com/docs/connect/) for the provider's current access model.