Get started with 1Password Security Automation

Learn how to connect your security automation platform to 1Password Enterprise Password Manager to programmatically remediate your security and incident response workflows within your 1Password account.

1Password security automation integrations let you connect 1Password Enterprise Password Manager to your security automation platforms, enabling automated identity remediation. Set up incident response workflows to authenticate and trigger enforcement actions in your organization’s 1Password account with no manual action required, such as automatically suspending a user directly in 1Password when suspicious sign-in events are flagged.

Security automation integrations are built on the OAuth 2.0 framework to securely authorize the applications you delegate to act on your behalf. Use scoped, revocable OAuth credentials to follow the principle of least privilege.

To get started with 1Password security automation integrations, you’ll need to have a 1Password Business or 1Password Enterprise Password Manager account, and be an owner, administrator, or part of the Security group.

Important

Security automations are not currently supported if you use automated provisioning with your 1Password account. You can manage actions through your identity provider.

Step 1: Create an OAuth application in your 1Password account

To connect your security automation platform to 1Password, you’ll need to create an OAuth application in your 1Password account. This generates the client credentials your platform will use to request an access token.

  1. Sign in to your 1Password account.

  2. Select Integrations in the sidebar. If you’ve set up other integrations in your account, you’ll also need to select Directory on the Integrations page.

  3. Select OAuth Application.

  4. Select Client credentials as the grant type, then select Next.

  5. Configure your OAuth application:

    • Application name: Enter a name to help you identify the integration.
    • Scopes: Select one or more of the scopes from the “Select scopes” list, according to the access required for your integration. Options include view users, suspend user, and reactivate user. Choose the least-privileged permissions your integration needs.
    • Description: (Optional) Add a description with additional information about your OAuth application.

    When you’re finished, select Next to generate your client ID and client secret.

  6. Select Save in 1Password and choose the vault where you want to save your client credentials. The client secret is only shown once, so make sure to save it before you continue.

  7. Select View integration.

The scopes of an OAuth application can’t be changed after it’s created. If your integration needs different scopes, create a new application, then revoke the old one. You can also rotate the client secret of an existing application without creating a new one.

Step 2: Connect your security automation platform

Security automation applications and services collect information from 1Password through requests to the 1Password Users API. Requests are authenticated with an access token generated from your client credentials. Actions your platform takes through the API, such as suspending or reactivating a user, are recorded in your account’s audit log in the same way as actions taken in the admin console, and identify Oauth app as the actor.

After you create an OAuth application, follow your Security Orchestration, Automation, and Response (SOAR) platform’s setup steps to connect it to 1Password using your client ID and client secret.

BlinkOps logo BlinkOps CrowdStrike logo CrowdStrike Elastic logo Elastic
Sumo Logic logo Sumo Logic Tines logo Tines Torq logo Torq

If your security automation platform isn’t listed, you can build your own client using the 1Password Users API or contact your platform provider.

Manage the OAuth application in your 1Password account

Rotate the client secret

If you need to replace your client secret, you can rotate it from the OAuth application in your 1Password account.

  1. Sign in to your 1Password account.
  2. Select Integrations in the sidebar.
  3. Select the OAuth application where you want to rotate the client secret.
  4. Select Rotate client secret. Enter your account password, then select Rotate secret.
  5. Select Save in 1Password and choose the vault where you want to save your new client credentials. The new client secret is only shown once, so make sure to save it before you continue.

When you rotate a client secret, the previous secret stays valid for 6 hours. This grace period allows you to update your integration without downtime, but you should update your integration with the new client secret right away to avoid disruption.

Revoke an OAuth application

Revoking an OAuth application removes it from your active integrations and revokes all access tokens generated with those client credentials.

  1. Sign in to your 1Password account.
  2. Select Integrations in the sidebar.
  3. Select the active OAuth application you want to revoke.
  4. Select Revoke integration. Enter your account password, then select Revoke integration to confirm.

Get help

For questions about configuring an integration for your security automation platform, contact the platform provider.

For questions about security automation or the 1Password Users API, contact 1Password support.

Learn more


Published: