Skip to main content

​
Overview

The 1Password integration lets you store integration credentials (API keys, tokens, passwords) in 1Password and reference them in Tierity by name — rather than pasting raw secrets into the UI. When Tierity needs a credential, it fetches the current value from 1Password at runtime. This is useful for teams that already manage secrets centrally in 1Password and want to avoid duplicating credentials in Tierity’s configuration.

​
How it works

When you configure an integration in Tierity that supports secret references, you can enter a 1Password reference instead of the raw credential:
For example, instead of pasting an API key directly, enter {{op.Snyk Production.credential}}. Tierity resolves the reference against your 1Password vault at runtime.

​
Prerequisites

  • A 1Password Teams or Business account
  • 1Password Connect server deployed and accessible to your Tierity instance, or a 1Password Service Account token
  • Manage access (or higher) in Tierity

​
Credentials required

Choose one of: Use a Connect server if you have one deployed. Use a Service Account token for a lighter-weight setup without running a Connect server.

​
Setup — Connect server

1

Deploy 1Password Connect

Deploy the 1Password Connect server in your infrastructure by following 1Password’s Connect server setup guide.The Connect server must be reachable from your Tierity backend.
2

Create a Connect token

  1. In 1Password, go to Developer Tools → Connect Servers.
  2. Select your Connect server and click Manage Access.
  3. Create a token with Read access to the vaults that contain your integration secrets.
  4. Copy the token.
3

Configure in Tierity

  1. Go to Config → Integrations → 1Password.
  2. Select Connect Server.
  3. Enter your Connect Server URL and Connect Token.
  4. Click Save & Test.

​
Setup — Service Account

1

Create a Service Account

  1. In 1Password, go to Settings → Service Accounts.
  2. Click Create a Service Account.
  3. Name it “Tierity” and grant Read access to the vaults containing integration secrets.
  4. Copy the service account token (ops_sa_...).
2

Configure in Tierity

  1. Go to Config → Integrations → 1Password.
  2. Select Service Account.
  3. Enter your Service Account Token.
  4. Click Save & Test.

​
Referencing secrets in integrations

Once 1Password is connected, any integration credential field in Tierity accepts a reference in the format:
Examples:
Item titles and field names are case-sensitive and must match exactly as they appear in 1Password.

​
Security

  • Tierity never stores the resolved secret value — it fetches from 1Password at runtime each time the credential is needed.
  • The Connect token or Service Account token is stored encrypted in Tierity’s database.
  • Rotate the Connect token or Service Account token from 1Password without changing any integration configuration in Tierity.

​
Disconnecting

  1. Go to Config → Integrations → 1Password.
  2. Click Disconnect.
  3. Confirm.
After disconnecting, any integrations using {{op.…}} references will fail until you either reconnect 1Password or replace the references with raw credential values.