1Password Connect is a self-hosted server that provides applications and cloud infrastructure with secure, programmatic access to secrets stored in 1Password vaults. Deployed within a user's private infrastructure, it acts as a bridge to the 1Password service, utilizing a private REST API for retrieving, creating, updating, and deleting items and vaults. The architecture consists of two primary components, typically deployed as containers: one for serving the API and another for synchronizing and caching an encrypted copy of the secrets from 1Password.com. Authentication is managed through access tokens, which can be configured with specific vault permissions and expiration dates to enforce least-privilege access.
The system is designed for secrets automation workflows and developer toolchains, offering local caching that provides high availability and low-latency access while bypassing public API rate limits. Connect integrates with various tools and platforms, including Infrastructure as Code (Terraform, Pulumi), configuration management (Ansible), and CI/CD pipelines (GitHub Actions, Jenkins). For containerized environments, it offers integrations for Kubernetes through a dedicated Operator and Helm charts, allowing for the injection and synchronization of secrets within clusters. The 1Password CLI can also be configured to use a Connect server for command-line operations.
