1Password Business for Enterprise: Architecture, Deployment, and Secure Operations

Overview

1Password Business is an enterprise password manager and secrets platform designed to protect workforce credentials, secure sharing, and reduce credential sprawl across SaaS, endpoints, and development workflows. Enterprises use it to centralize vault-based access, enforce strong authentication with SSO and MFA, support delegated administration, and extend secrets retrieval into automation through the 1Password CLI and service accounts.

Core use cases include:

• Secure storage of passwords, API keys, SSH keys, and software licenses
• Shared vaults for teams, projects, and privileged operational tasks
• SSO integration with Microsoft Entra ID, Okta, or Google Workspace
• SCIM-based provisioning and lifecycle management
• Secrets access in CI/CD pipelines using op
• Auditability through events, reports, and admin controls

Architecture

1Password Business uses a SaaS control plane with client applications for desktop, mobile, browser, and command-line access. Data is protected with end-to-end encryption using an account password plus a device-bound Secret Key, reducing server-side exposure.

Core components

• Business account: tenant boundary for users, groups, policies, and reporting
• Vaults: logical containers for secrets with granular permissions
• Clients: browser extension, desktop app, mobile app, and op CLI
• Identity integration: SSO via SAML/OIDC and automated provisioning with SCIM
• Service accounts: non-human identities for vault access in automation
• Events API / reporting: operational visibility for admins and compliance teams

Deployment model and data flow

1. User authenticates with SSO and unlocks 1Password using local credentials and Secret Key material.
2. Client retrieves encrypted vault metadata from 1Password cloud services.
3. Decryption occurs on the client side.
4. Vault permissions are enforced by account policy and group membership.
5. CI/CD jobs authenticate with a service account token and read only the vault items explicitly granted.

This model fits zero-trust principles because possession of cloud-stored ciphertext alone is insufficient without local secrets and authorized identity context.

Implementation Guide

1. Install the CLI

brew install 1password-cli
op --version

For Linux:

curl -sS https://downloads.1password.com/linux/keys/1password.asc | sudo gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg
echo 'deb [signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] https://downloads.1password.com/linux/debian/amd64 stable main' | sudo tee /etc/apt/sources.list.d/1password.list
sudo apt update && sudo apt install -y 1password-cli
op --version

2. Sign in to the business account

op account add --address company.1password.com --email admin@company.com --signin
op account list

3. Create a vault and assign access

op vault create Engineering-Prod
op group create engineering
op group grant --vault Engineering-Prod --permissions allow_viewing,allow_editing engineering

4. Create a service account token

Generate a service account in the admin console, grant it access to Engineering-Prod, then export the token in your runner:

export OP_SERVICE_ACCOUNT_TOKEN="ops_xxxxxxxxxxxxxxxxxxxxxxxxx"
op vault list

5. Store and retrieve a secret

op item create --category=apiCredential --vault Engineering-Prod --title "Stripe Prod" username="svc_stripe" credential="sk_live_xxx"
op item get "Stripe Prod" --vault Engineering-Prod --format json

6. Use an environment file for local development

cat > 1password-credentials.env <<'EOF'
export OP_SERVICE_ACCOUNT_TOKEN="ops_xxxxxxxxxxxxxxxxxxxxxxxxx"
export OP_VAULT="Engineering-Prod"
EOF
source ./1password-credentials.env

Code Examples

Example 1: Bash secret retrieval for CI

#!/usr/bin/env bash
set -euo pipefail
export OP_SERVICE_ACCOUNT_TOKEN="$OP_SERVICE_ACCOUNT_TOKEN"
DB_PASS=$(op read "op://Engineering-Prod/Postgres/password")
export DB_PASS
./deploy.sh

Example 2: GitHub Actions workflow

name: deploy
on: [push]
jobs:
  app:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install 1Password CLI
        run: |
          curl -sS https://downloads.1password.com/linux/keys/1password.asc | sudo gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg
          echo 'deb [signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] https://downloads.1password.com/linux/debian/amd64 stable main' | sudo tee /etc/apt/sources.list.d/1password.list
          sudo apt update && sudo apt install -y 1password-cli
      - name: Read secret
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
        run: |
          export API_KEY=$(op read "op://Engineering-Prod/Stripe Prod/credential")
          echo "API key loaded for deployment"

Example 3: Python retrieval with subprocess

import os
import subprocess
secret_ref = "op://Engineering-Prod/Postgres/password"
env = os.environ.copy()
value = subprocess.check_output(["op", "read", secret_ref], env=env, text=True).strip()
print(f"Retrieved secret length: {len(value)}")

Security Hardening

• Enforce SSO + MFA for all workforce users and require device trust where supported.
• Use least-privilege vault design: separate HR, Finance, Engineering, and Production vaults.
• Prefer service accounts over shared human credentials in automation.
• Rotate high-value secrets on a fixed schedule and after personnel changes.
• Restrict admin roles and review event logs for vault permission changes.
• Disable unmanaged exports where policy allows and require approved clients.
• Protect endpoints with full-disk encryption and EDR because decrypted secrets exist on trusted devices during use.

Comparison

Troubleshooting

Error 1: Invalid service account token

Log sample:

[ERROR] op: failed to authorize request: 401 Unauthorized
{"status":401,"message":"invalid service account token"}

Fix: Verify the token is current, exported in the shell running the job, and not truncated by CI secret masking or whitespace.

Error 2: Vault permission denied

Log sample:

[ERROR] op read: you are not authorized to access this vault or item
403 Forbidden: insufficient permissions for vault Engineering-Prod

Fix: Confirm the service account or group has explicit access to the vault and item category, then rerun op vault list to validate scope.

Error 3: Account sign-in mismatch

Log sample:

[ERROR] no accounts configured for this domain
[DEBUG] requested account: company.1password.com
[DEBUG] configured accounts: company-enterprise.1password.com

Fix: Remove the wrong account entry with op account forget <shorthand> and re-add the correct tenant URL.

Best Practices

Do

• Create vaults by data sensitivity and operational boundary, for example Prod-DB, HR-Restricted, and Shared-IT.
• Use groups mapped from IdP roles for deterministic access reviews.
• Store machine secrets with clear item titles and ownership metadata.
• Test secret retrieval in a non-production vault before pipeline rollout.

Don't

• Do not place all enterprise secrets in a single shared vault.
• Do not embed service account tokens directly in source code or container images.
• Do not grant Business account admin rights to application operators who only need vault access.
• Do not rely on password storage alone; pair 1Password with endpoint security, SSO policy, and periodic access recertification.