> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/getting-started/entitlement-data-discovery/credentials-discovery/1password-credentials.md).

# 1Password: Credentials

### Overview

BalkanID supports discovery and governance of credentials within 1Password as part of **IGA for Non-Human Identities (NHI)**.

All credentials are normalized into the BalkanID data model and surfaced in the Credentials tab, along with their associated identities, access relationships, and risk insights.

The associated credentials can also be seen under the specific application integration (1Password) page.

### Required 1Password configuration for Credential Discovery

Credential discovery uses the same **service account API token** configured in [1Password Integration Setup](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integrations/1password-integration-setup.md). No additional 1Password permissions are required beyond the vault access already granted to that service account.

Enable the credential and insight types you want under **Insights and Credentials** in optional configuration when saving the integration. Enable **Vaults** under **Entities** when extracting vault-stored credentials — vault metadata is required to link credentials to access chains.

BalkanID retrieves **metadata only** — secret values (passwords, API keys, secure-note contents) are never stored.

{% hint style="info" %}
**Early Access:** Credential and insight discovery requires **IGA for Non-Human Identities (NHI)** to be enabled for your tenant.
{% endhint %}

### Credential Types Supported

BalkanID tracks the following 1Password credential types:

{% hint style="info" %}
Note: The credential types listed below represent the supported set of 1Password credentials extracted today. Financial, identity, and document item categories are excluded from credential discovery.
{% endhint %}

#### **Source credential (1Password-native)**

* Service Account Token — the programmatic token configured for the BalkanID integration (metadata from `op whoami`; the token value is never stored)

#### **External credentials (vault-stored items)**

* Login
* Password
* API Credential
* Secure Note
* Database
* Server

### Access and blast radius

1Password items do not have per-item ACLs. Access to a vault credential is inherited from **vault permissions** already modeled in BalkanID (user → vault and group → vault). Credentials appear as standalone entities linked to their vault; identities reach them transitively through vault access.

### Insights supported

When **Insights** are enabled in optional configuration, BalkanID evaluates vault-stored credentials using item creation time:

* **Credential Not Rotated For 90 Days** — item created more than 90 days ago
* **Credential Extremely Old** — item created more than 180 days ago

{% hint style="info" %}
1Password CLI item list metadata does not include last-used time. BalkanID does not emit unused-credential insights for 1Password items because that data is unavailable from the integration API.
{% endhint %}

### Common risks associated with 1Password credentials include:

* Credentials Not Rotated for 90+ Days: Vault-stored logins, API credentials, or server items that remain unchanged long after creation.
* Extremely Old Credentials (180+ Days): Long-lived vault items that have never been rotated, increasing exposure if compromised.
* Over-Broad Vault Access: Groups or users with vault permissions that can reach large numbers of programmatic secrets.
* Stale Integration Service Account: The BalkanID service account token with access to vaults that are no longer needed for governance scope.

This ensures visibility and governance of programmatic secrets stored in 1Password, forming a critical part of IGA for Non-Human Identities.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.balkan.id/getting-started/entitlement-data-discovery/credentials-discovery/1password-credentials.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.