1Password Credential Broker is now in public preview

Every security team has tried to trace a credential access event back to a specific workload, and received nothing but a "service account." That service account probably had access to an entire vault, and its audit trail doesn’t tell you which repo triggered the request, which specific credential was accessed, or whether the workflow still has access. When an auditor asks, or an incident occurs, that's not a good place to be.

The credentials feeding those workloads are usually created for convenience: scoped broadly to avoid last-minute permission errors, stored in plaintext .env files, placed directly in CI/CD pipelines, and rarely rotated because doing it manually is slow and error-prone.

1Password Credential Broker was built to close that gap: give every workload or agent its own identity and scope its access. Every issuance event gets logged with attribution clear enough to hold up in an incident review. Today, we're moving Credential Broker from closed beta to public preview, available for all Enterprise Password Manager Business customers to start using right now.

How 1Password Credential Broker works

The foundation of our Credential Broker is Workload Identity Federation, a standards-based approach that GitHub, Google Cloud, AWS, and Azure have all adopted. When a GitHub Actions workflow runs, GitHub automatically generates a signed token that identifies exactly which repo, branch, and workflow is executing. Think of it like a digital badge: here's what this job is and where it came from.

Our Credential Broker validates that badge against a trust policy you configure, then delivers only the specific credentials that job is approved to retrieve. The workload can retrieve only the approved credential during the authorized job, without receiving standing access to the vault. We log every issuance with full attribution: the repo, branch, workflow, environment, and commit that triggered the request. Your audit log no longer reads "a service account accessed this…